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PUBLISHER'S NOTE 


This book is written as an information guide for 
those who wish to learn about and experiment with 
software protection and duplication methods. It is 
not intended to encourage theft or illegal uses of 
copyrighted software. 

All information in this book is accurate insofar 
as can be determined by the authors and publisher. No 
liability can be assumed for any inaccuracies which may 
be inadvertently contained herein. 

The user of this information must assume all 
liabilities associated with its use. The user must 
also assume all risk to person or property associated 
with the use of the circuitry described in this book. 
It is recommended that the user be technically 
competent to determine the suitability of the 
application. In no event shall the authors or 
publisher be liable for incidental or consequential 
damages in connection with the use of the information 
in this book. 

C-64, VIC-20, and MONITOR$8000 are trademarks of 
Commodore Business Machine, Inc. 

Romulator, Tapeworm, PSIPACK and its program names 
are all trademarks of PSIDAC. 


*** PROGRAM NOTES *** 

Most of the Basic programs will require that you 
use CBM "shorthand" when typing to avoid excess memory 
use. 


Programs have been written for the Commodore 1541 
disk and 1525 printer. Many of the programs have been 
tested on a version of the MSD. The programs which 
"talk" to the drive controller such as Diskpicker and 
error analyzers will not work with MSD. The others may 
work. 


THE SOFTWARE PROTECTION HANDBOOK 

Copyright c 1984 by PSIDAC. All rights reserved. No 
part of this publication may be distributed by any 
means. The circuits and programs contained herein and 
on the PSIPACK disk may be copied for personal use. No 
part of this book may be reproduced for publication. 

SPH-64 VI284 USD19*95 
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PREFACE 


The writing of this book was undertaken as a result of 
the large number of inguiries and strong interest developed 
after the release of our first book "The Software Pirate's 
Handbook for the VIC-20" (SPH-20). This book will follow a 
similar format to the SPH-20 and, although each are complete 
books in their own right, this book is designed as a 
complement to SPH-20. 

The SPH-64 will expand on both the philosophy and 
technique of duplicating software. In doing so we want to 
dispel many of the doubts and fears that people often have 
about copying software. We also want to be sure that the 
legal issues are understood so that we do not promote theft 
or black-marketing of software which clearly are crimes. At 
the same time we will show you how to protect your own 
investments by making back-up copies of a variety of 
"protected" forms of software. 

This book will first cover our philosophy for copying, 
and specific legal considerations. In the following 
chapters we will outline technical theory and concepts with 
specific numbered procedures and the program listings at the 
end of applicable chapters. In many cases you will be able 
to go directly to the specific procedure for the type of 
copy you wish to make. However for a better understanding 
or in case of difficulty in making a copy, you may need to 
refer to the sections which give attention to theory and 
concepts. In this manner you should be able to gain an 
understanding of the kinds of protection that you are 
encountering so that you can deduce possible 
"countermeasures". 

The ultimate purpose of this book is not to provide you 
with the "newest thing" in copy history, but rather, we will 
try to provide you with primary tools and knowledge of 
protection systems. These tools are not candied for appeal 
but are essential utilities which are themselves open and 
unprotected so that you can use, study, and adapt them to a 
continually changing market. Our experience has shown that 
"packaged" protection breaking software becomes obsolete as 
fast as it is written, leaving the consumer with yet another 
hole to pour money into. Adaptive programs and user skills 
are necessary to stay current. In light of this, we offer 
this book, not as the final word, but as what may be the 
first technical reference document available on the subject. 
Together with the programs included, this makes a powerful 
analytical package for defeating protected software. 

We greatly hope that you find this book informative, 
understandable, and USEFUL! 

The authors. 
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*** CHAPTER ONE *** 


INTRODUCTION 


PIRACY...an issue so clouded with fear, intrigue, 
and misinformation that you dare only to utter it in 
safe, familiar company. The original title of this 
book was to be "The Software Pirate's Handbook II", but 
had to be changed after several advertisers flatly 
refused to advertise a book of that title in spite of 
the fact that the book was never meant to encourage 
piracy in any form. The use of "Pirate" was intended as 
a light-hearted reference to any copying process, and 
to inspire a certain tendancy of humankind; the 
attraction to things mysterious or secret. 

Unfortunately, there is a great deal of hocus- 
pocus and puffery being used to cloak the alleged 
brainchildren of this new market. This reletively new 
consumer product - software - is being hawked, with all 
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the vigor and claims of mysterious powers,like the 
patent medicines of earlier years. This technocratic 
rhetoric is replete with all the rumored pitfalls and 
warnings of what may happen to you or your equipment if 
you try to exercise your documented legal right to copy 
the product. All of this has the detrimental end effect 
of deluding the consumer into purchasing overpriced, 
underperforming products. In our opinion this will 
most certainly undermine the strong beginning and 
curiosity the home microcomputer market now has. It is 
our goal to provide the public with some knowldge, 
tools, and attitudes that will be a start in changing 
this situation. I see two futures for home 
microcomputing, one with software and computers 
accepted and used by many, and the other with software 
and computers rejected as expensive "hyped" toys of a 
bygone fad. 

At this point we must separate the difference 
between what is acceptable copying and what is Piracy. 
Quite simply, the intent of the user will decide the 
question. Copying for sale, distribution or other non¬ 
personal uses is Piracy. Copying for backup, archival, 
study, and other personal uses is not piracy. Loaning 
your original to another person for temporary use is 
not piracy. (If that ever were changed we may as well 
burn the libraries and return to the Dark Ages!) 
However copying an original you do not own is 
unethical. 

We should start to analyze this whole issue of 
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copying software by first classifying software amongst 
the products with which it belongs. This will also help 
to peel away some of the misinformation that surrounds 
the issue. To get very basic, software is a set of 
instructions which produce a desired effect on a 
physical system. Software is written with letters and 
numbers and can be embodied in many different forms 
such as; verbal, magnetic recording, paper, solid state 
and so on...just like this book or a piece of music or 
a recipe for example. The fact is that the examples 
that I have given are just as common or likely to be 
found in one of the formats listed as software itself, 
with the exception of solid state, which refers mainly 
to ROM memory. The reason that books and other 
typically printed materials are not commonly found in 
this format is that they inherently contain vastly 
greater amounts of data than the average program. Any 
one of these also often cost more to produce, take more 
expensive equipment, and more time to write than a 
piece of software. How strange it is then that software 
should sell for tens of times more money than these 
other like products! 

I suppose that the real mystique of software, and 
the factor most capitalized on, is it's code-like 
nature. Few people are professional programmers and 
thus cannot really understand the mysterious language 
of the program. Some might say that all that is 
important is that the user be able to use the program 
and that the degree of secrecy or protection applied to 
the program is not a concern. 
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We feel that this is a 


little like a homemakers magazine saying that you 
should only be able to eat the end result of a recipe, 
not be able to understand the words and numbers which 
define the end product! If you only wish to eat and 
care less about the ingredients, that is your 
perogative, but if you like to understand what you are 
eating, there really should be no great mystery about 
the ingredients. 

When it comes to making a copy of a piece of 
software many people get cold feet. In selling the 
"Pirate's Handbook" for the Vic-20, we advertised "for 
archival use only". We recieved many promises, signed 
statements and so on from our customers that they would 
use it only for ’'archival" purposes. I am sorry that so 
many people have been bullied into thinking that they 
might be required to make such a statement in the first 
place. I have yet to meet a person who felt the need to 
sign an affadavit before running up to the local 
grocery store to make a copy of a magazine article, 
pages of a book, recipe or whatever. Probably the only 
situation even near in comparison would be the fear of 
attempting to photocopy a dollar bill to try in a bill 
changer, (it doesn't work!) 

A recent manifestation of this biased thinking on 
software appears in a proposal being considered for 
state law in Louisiana. The law, if enacted, would 
mandate that the act of purchasing and subsequently 
opening the package of a piece of software, would 
inherently place the "opener" in a legal contract with 
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the seller. The purchaser would be obligated to refrain 
from copying, distributing, and whatever else they 
throw in. I hope they have a lot of jail space in 
Louisiana! 

One of my favorite analogies which may help you to 
put this whole ethical question in perspective is the 
recipe analogy. Consider the fact that a recipe like 
software is a set of written instructions which cause a 
desired effect on a physical system. Like software, it 
requires a sequence of steps to be performed in the 
correct order in real time. Both require specialized 
hardware to perform their respective functions. As with 
computer hardware, a complete cooking system easily 
costs thousands of dollars. Developing a unique recipe 
requires specialized skill as well as a great deal of 
time. 


Some of the major differences are a result of the 
general perception of a recipe as an ordinary everyday 
commodity often given away and the perception of a 
program as a highly valuable and unfathomable product. 
It is easy to believe that a great deal more knowledge 
and effort goes into a program than a recipe. However 
there are a lot of professionally trained chefs who 
would argue otherwise! Judging from some of the 
"professional" software that I have seen marketed, I am 
quite sure that they are right! 

If you can then, consider that these diverse yet 
similar copyrightable literary forms should be given 
equal treatment and respect when we think of copying. 
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Are womens clubs and church groups that exchange 
recipes (many of which are blatantly copied from the 
pages of magazines) commiting an act of piracy? 
Probably they are in the strictest sense, but who 
really cares!? It doesn't appear that their doing so 
has seriously affected the market. If taken case by 
case, each category of information market has a similar 
situation. For each of these markets there is some 
form of equipment and general knowledge of methods for 
making copies of the copyrighted product. Your right to 
own and know these facts has never really been 
disallowed. Otherwise, tape recorders, photocopy 
machines, and probably even cameras could have been 
outlawed due to their potential for illegal use in 
copying protected information. Each of these markets 
also face the real threat of blatant piracy by those 
who would profit by use of copy technology. The current 
misunderstanding of the ethical question of copying 
software is not a result of a factual difference in the 
nature of software but rather a simple difference in 
the typical perception of software versus more commonly 
understood information like a recipe. 

Historically software has been a closely guarded 
secret of the company owning it. This results largely 
from the fact that prior to 1980 software had no legal 
form of protection. It did not fall under patent law or 


copyright 

law. 
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use 
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necessarily high. As a result companies were rightfully 
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worried about being ripped-off by those who might copy 
their software and sell it without fear of punity. This 
unfortunatly, happened too often. More recently for 
example, Franklin computer copied many versions of 
Apple computer's operating system. The uncertanty of 
the new laws protecting software prevented Apple from 
stopping this apparently obvious case of piracy. 
Although the two companies finally came to an out of 
court settlement, the 3rd U.S. Circuit Court of Appeals 
in Philadelphia ruled that the software was protected 
under current copyright law. "Piracy” of this form 
could quite literally, bankrupt a company. The 
operating systems of a microcomputer are closely linked 
to the hardware design of a system. A company stands to 
lose the fantastic amount of investment that it takes 
to set up production and marketing if unscrupulous 
persons pirate these software systems to install in a 
competing computer. In effect, this creates a limited 
monopoly for the original manufacturer. If a competitor 
wishes to make a 100% compatible alternate, the 
operating system he uses must be identical in 
performance. For technical reasons, this is virtually 
impossible Xo do without copying the operating system! 
Although legal protection for ROM based operating 
systems has been upheld in court, the issue is long 
from being settled. 

The heart of the copyright intent is that the 
specific expression of an idea is copyrightable but the 
idea is not. Ideas must be free of legal encumbrances. 
However* if the idea can only be expressed in one way 
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without losing its meaning, then the ability to protect 
that idea becomes very limited. The same sort of thing 
is true when product names become so common as to be 
considered generic. Legal protection is lost. Thus I 
can talk about crescent wrenches and skill saws 
without worrying about the legal ramifications. There 
is not a clearly defined legal answer available for 
this problem with operating system software. The real 
answer may lie in the intent of the person making the 
copy. 

From another viewpoint, an applications package 
which may take a month or so for a single person to 
write and an average investment to produce and market 
should not be priced as the basis for a lifelong 
income. This does not mean that it should be stolen and 
distributed according to some modern Robin Hoodian 
mentality. It does mean that the over-pricing of 
applications software creates a climate where such 
piracy is going to be common. If the price better 
accommodated the market, the tendancy of people to 
distribute copyrighted software would greatly diminish. 

Protection of software is clearly not the answer. 
I would not even recommend that anyone buy software if 
the protection methods seem too strong. The ability to 
make backups and expect a reliable and compatible 
product are rights of a consumer. As later chapters 
will bear out, some of the more elaborate protection 
schemes can prove rather unreliable. Often they are 
obvious encumbrances to smooth loading and running of a 
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program. Furthermore, in the case of disks, they often 
are not compatible with other brands of disk drives. 
The real clincher is that Commodore, or any other drive 
manufacturer, reserve the right to update their drive 
hardware/software at any time as needed. Protection 
schemes which operate beyond the defined specifications 
of the system would not necessarily work on an 
"updated" system! The drive manufacturer has no 
obligation to try to figure out what has been done 
beyond the original accepted specifications. If you 
don't believe this is a real problem, try talking to 
anyone who has bought "Commodore compatible" hardware. 

The difficulty of backing up highly protected 
software places you in the vulnerable position of 
facing complete system crash and resulting data loss. 
In many cases I can think of it would be totally 
unacceptable to even run a program without having a 
backup accessible within minutes. Although failure of 
the storage medium is more common with tapes and disks, 
it is still possible with cartridges. The major 
problems with cartridges are that a lot of wear and 
tear is placed on the port by constantly changing 
cartridges. As anyone experienced in failure analysis 
could tell you, the weakest link in many electronic 
systems is the mechanical interface such as edge 
connectors. I have seen them become loose, bent, 
intermittent and who knows what else. One popular 
solution has been to use expander boards with 
switchable slots but these are quite expensive and 
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still limit the total number of cartridges you may use 
without switching. Our solution is to use an external 
RAM memory which can be loaded from tape or disk and 
then emulate the original ROM cartridge. This way, the 
RAM unit is left in the computer and does not interfere 
with any other operation. When desired, the cartridge 
program which was previously saved on disk or tape can 
be loaded and reloaded as needed. Your cartridges can 
be put away safely and be used only to make backups. 
The obvious problem with this system is that people who 
don't own the cartridge could illegaly obtain copies of 
the tape or disk and use the program without purchasing 
it. We strongly discourage this. It is an illegal act 
of piracy. Chapter 7 gives specific details on this 
system. 

The point of importance is that without a backup 
copy of each program you endanger yourself needlessly. 
Feeble attempts of software houses to remedy this by 
offering backups if your original fails, simply do not 
solve the problems. This is true even IF the backup 
policy is quick and promises a replacement within say 
24hrs. What happens if the original company goes out of 
business? What if the user faces a deadline or is in 
the middle of a presentation? In some cases a delay of 
more than some minutes can be devastating. In our 
opinion there is only one rule and all should take 
heed: Only a fool runs a program without a backup but 
it is a fools fool who runs a program without a backup 
of the backup! For those really important programs we 
recommend that backups be stored in two different 
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locations. In one case, one of our programs was 
recovered from a disk which had it's protective cover 
cut away and had been thrown in the trash - after being 
passed around to show how they were constructed! One 
of the first things you should do especially with a new 
disk or tape is to make a backup. 

It is likely that you may hear about a "great" 
program but find out it is uncopiable or very hard to 
copy. We ask? are you willing to suffer the 
consequences of a failure with no backup? Is it then, 
really such a great program? The truth is that such a 
program rewritten with no protection is much more 
valuable and marketable. The irony is that selling a 
program with significant modification may not even BE a 
violation of copyrights. "Reverse engineering", an 
accepted industrial practice of distilling the 
underlying principals of a product and then marketing 
your own version, has always been a common source of 
"improved" products. 

Another issue which creates a problem for those 
who purchase software is the lack of documentation of 
the program itself. Not all people want or care to try 
to modify a program to suit their application but for 
many the original program may be ill suited to their 
needs. These people have a legitimate need to be able 
to list and modify the program. Without adequate 
documentation, this is nearly impossible. Our 
philosophy is that if you buy our book we are happy to 
give you our listings and you may make any changes that 
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suit your special wishes. We feel that all software 
should be sold with listings and documentation or that 
they should be available for a reasonable price. The 
ability to customize is a unique feature of software 
which should be capitalized on instead of hidden. Some 
products are naturally customizable some are not. The 
custom car parts industry has made a fortune on this 
very fact. Occasionally a potentially valuable piece of 
software is totally useless to a person because of the 
inability to modify it. 

The consumer has a legal right to expect a product 
to perform the "normal" functions associated with that 
type of product. In legal terms this is known as the 
merchantability of a product. Imagine that you buy an 
"all purpose" fertilizer for flowers. After reading all 
directions and using it, your roses do great but all 
your other flowers die. Let's say that after talking to 
your friend, a chemist, you find that it would work on 
other flowers - IF you had specialized knowledge of the 
chemical compounds used and how they could be applied 
successfully to other flowers. A lawyer would probably 
tell you that you have legal grounds for recovery 
because the product is not merchantable as an all 
purpose fertilizer without sufficient instructions on 
how to use it successfully, and any "normal" 
application does more harm than good. In the 
microcomputer business, there are many programs sold 
with the implication that they will do many things. 
Only after purchasing might you find out that it would 
require specialized knowledge or even modification to 
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make it work to reasonable expectations. Since backup 
copying of owned software is a legal right I wonder if 
a copy protected program itself violates the principal 
of merchantability. As long as we have that right it is 
reasonable to expect software to be copyable. 

Time and again various industries have gone 
through this "secrets" game only to find in the end 
that a large number of the consumers have a right, 
need, and demand to know what's inside. Limiting or 
protecting this information can only limit the 
useability of the equipment and also limits the growth 
of add-ons which make the original product more useful. 
Software houses would certainly view this as opening 
the door wide to the pirates. Already terrified by loss 
Df profits due to piracy they find more and more 
elaborate and costly protection to be the answer. Yet 
this is the very thing that makes the market so 
attractive to the pirates in the first place! Take away 
the protection and high price, and who would need a 
pirate anyway!? 

In strict legal terms, software has been protected 
by U.S. copyright law since 1980. Anyone who makes a 
copy of software and gives it away or sells it is in 
direct violation of these laws and prosecution is 
available. Other information forms have survived very 
well with copyright law as the only means of 
protection. The pricing has been set by the accepted 
method of market determination and copying and 
exchanging amongst small groups or by friends has never 
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seriously affected the market. The thought of a ladies 
sewing circle being sued for exchanging patterns seems 
ludicrous because it is. Large scale piracy does not 
occur as a result of grocery store photocopy machines 
because the original is priced low enough that it 
wouldn't be profitable. With the areas of legality 
clearly defined, no one should feel intimidated or 
afraid to make a copy of software for backup purposes. 
The existance of copying hardware, software, and 
information should be no more threatening than a 
photocopy machine or tape recorder and the knowledge of 
how to use them! 
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*** CHAPTER TWO *** 


TOOLS 


Without a doubt the C64 is a powerful computer and 
a very versatile tool. However, the first time that you 
try to save a protected program you might suddenly feel 
like a child given the task of decrypting a classified 
and encoded top-secret document. A myriad of questions 
immediately present themselves. Where do you start? 
What kind of program is it? What methods of protection 
have been applied? Is there any way to list it? Where 
does the program reside in memory? And so on... It is 
often difficult to decide which questions to ask in the 
first place! 

It would be wonderful if someone made a super¬ 
copier that would copy any software with the ease that 
a photocopy machine will copy this page. Unfortunately, 
there is just no way that a single answer will cover 
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the wide variety of possibilities available for copy 
protection. The only way to really be equipped for the 
task is to have various specialized tools. Most of the 
jobs cannot be accomplished with only one of the tools 
but will require skilled application of many different 
tools. The key here is skill. The most effective tool 
you can posses is a sound knowledge of how software can 
be protected so that you can make a meaningful analysis 
of each situation and apply the correct tools with the 
greatest amount of skill. 

In this chapter we will concentrate on 
familiarizing you with the kinds of tools to use on 
three categories of software media. These are, 
cartridges, disks, and tapes. Within these categories 
we will define "levels" of protection as they apply. 
The descriptions of tools will aquaint you with the 
general applications of the tools but we will leave out 
the specifics of use until the later chapters, which 
will list the procedures in a very detailed fashion. If 
breaking protected software is all new to you, this 
chapter should give you a good general understanding of 
what you are up against and what tools are available 
to help you. This should also help you develop plans of 
attack when you come up against a protected program 
that you need to back-up. 

—Cartridges— 

Cartridges are unique in that they are a form of 
protection in themselves. That is to say that the very 
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features of the cartridge are what protect the program 
that it contains. The fact that the computer is 
designed to autorun cartridges makes it difficult to 
break into and list the program or save it to another 
format. Since most people don't have PROM memory 
burning facilities, they cannot expect to make a "copy 
cartridge" from an original cartridge. Furthermore, the 
cost of PROM burners and circuit boards to implement a 
copy cartridge would make it expensive anyway. 

Actually cartridges are not that prone to failure. 
The simple excuse of making a duplicate cartridge for 
back-up purposes really isn't realistic in view of PROM 
making costs. We have developed a method that can be 
used to transfer cartridge programs to tape or disk and 
then run in a RAM expander! This makes the process very 
cheap if applied for many cartridges. With this system 
it becomes desirable to have back-ups for all 
cartridges you own. After all, if the cost is a little 
disk or tape real-estate, why not have a copy? There 
are good reasons to want a tape or disk copy, such as 
avoiding the hassle of continuously plugging and 
unplugging cartridges when changing programs. Making a 
modification of a program residing in a cartridge can't 
be accomplished unless the program can be put into RAM 
and run in RAM. A single disk can contain a whole 
library of programs while the cartridge holds only one. 
Having drawers full of odd shapped cartridges is a real 
pain. If, for example, you need to transport a library 
of cartridges to work each day, you would need an extra 
lunchbucket! But with your cartridge library on disk. 
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your software is very transportable. 

Remember that all these limitations in the 
cartridge medium are mostly to make copying less 
likely. It would be much cheaper for a software house 
to sell all of it's software on either tape or disk. 
Magnetic media does not require a circuit board or 
specially manufactured circuits and enclosures. 
Cartridges exist largely because of the fear of piracy. 
As is often the case, those with legitimate needs are 
penalized by actions of those with illegitimate greed. 

When the C64 is powered up one of the housekeeping 
chores that it does is to check to see if a cartridge 
is plugged in. Part of this is accomplished by two pins 
on the cartridge edge connector which are identified by 
the names GAME and EXROM. The job of these pins is to 
control the way the memory is configured on the C64 so 
that the computer will allow Basic, Kernal and ROM to 
be located as necessary. The initialization routines 
also check memory locations where a cartridge resides 
to see if an access code is found there. These codes 
then tell the computer that there indeed is a cartridge 
and they pass information to the computer so it knows 
where to start running the program from. A program 
doesn't need to start at the beginning of the cartridge 
memory to run. Most of the time the entry point is not 
at the beginning but further on in cartridge memory. 
Following is an Interrogate dump of the first several 
bytes of a typical ROM cartridge. Notice the ASCII 
(reversed) display which shows the access code CBM80. 
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The first four bytes before this code give the cold 
start and warm start addresses respectively. 


cs 

$8394 

WS $83AO 
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94 

83 

A0 

83 

C3 

C2 

CB 

38 


30 

02 

BE 

5fi 

30 

5F 

EE 

3D 

:01@SD$»9H9I6 

AS 

C0 

C0 

80 

57 

80 

57 

EE 

mszmmmi 

5 r* 

48 

01 

C4 

04 

40 

19 

CA 

:020U*BWE1 

CA 

4A 

19 

49 

C4 

04 

01 

C0 


—ROMULATOR— 

Romulator is a cartridge copy system that comes in 
three versions. One for the VIC-20, one for C64 tape 
systems and one for C64 disk systems. The C64 versions 
are identified as 2Romulator for disk and 3Romulator 
for tape. In this book we will refer to the C64 system 
as Romulator and leave the numbers out except when 
needed for specific procedures etc. Romulator consists 
of a special program which moves the contents of the 
cartridge then saves it to the magnetic medium being 
used. A special Romulator circuit card is used which 
allows changing the configuration of the GAME and EXROM 
lines thus preventing auto starting. This card is used 
with both the tape and disk versions of the C64 
software. The circuit card also has a socket for an 8K 
or 16K RAM expander. The RAM expander is the key since 
the tape or disk program can be downloaded to the RAM. 
The RAM is made to look like a ROM cartridge by the use 
of a write enable line which prevents erasing of the 
program by software means. Finally, the RAM location 
can be changed so that it will reside anywhere commonly 
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c 

used by commercial cartridges. ^ 

The general process is to use the Romulator ^ 

circuit card to determine the normal cartridge 
configuration, next set the switches to defeat the Q 

autorun and then to copy the contents of the cartridge C 

to the selected magnetic medium. The Romulator card ^ 

with RAM is left in the computer. It does not ^ 

interfere with any other operation. The cartridge can 
be stored away safely. When desired to run the program, C 

. . . C 

it is downloaded into the expander RAM which is then 

C 

write protected and switched into the configuration for ^ 

the cartridge being run. A system reset button on the £ 

Romulator card is then pressed to force a cold start. C 

Since the computer will see the cartridge configuration ^ 

and cartridge codes, it will run the program as though q 

the cartridge itself were plugged in! This can be done Q 

with 8K or 16K cartridges. To date we have not found C 

one that it will not work with. Chapter seven lists the 
exact procedures to follow as well as the programs and q 

circuits needed. £ 

C 

This book has been written with the aid of Quick 
Brown Fox word processor which we run on a Romulator 
system. The cartridge is safely stored in a drawer. It C 

is very nice to be free of the anxiety of having some ^ 

unexpected "glitch" destroy the cartridge and put us q 

temporarily out of business. Also gone is the fear that 
an overworked edge connector will become intermittent C 

or fail altogether. If you decide to set up a Romulator 
system for your computer you will find it a valuable ^ 

C 
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accessory. 

—DISKS— 

There are a wider variety of protection schemes in 
existence for disk than any other medium. It is 
understandable that software houses have developed so 
many forms of protection since an unprotected disk is 
so easy to copy. Many people would be tempted to avoid 
purchasing by copying from a friend, and a few might 
even try to make a profit by selling pirated copies at 
a much lower price. The protection methods we will 
cover will help you to protect your own disk software 
and to break protection when you need to make a back¬ 
up of one you have purchased. As a consumer, you should 
avoid purchasing "super protected" disks because of the 
limitations and insecurity they force upon the user. If 
the super protected program is the best thing around, 
you will have to weigh the disadvantages versus the 
quality of the software. You might perhaps settle with 
purchasing a second original if you need maximum 
protection from the eventual disk crash. When 
appropriate, we will spell out specific limitations and 
problems to normal function introduced by some forms of 
protection. 

We will define "levels" of protection to make our 
discussion easier. These are not in line with any 
"standard level", but are merely to give us a yardstick 
in comparing different kinds of protection. This may 
also help you in classifying programs that you wish to 
copy so that you can select the most appropriate form 
of "attack". 
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—PROTECTION LEVELS— 


Level 0.Unprotected. Can be saved by loading and 

saving. Contains basic only or basic loaded machine 
language. 

Level 1.Contains auto-run feature and a STOP 

disable poke in program. Doesn't allow saving but can 
be direct copied or Relocate/loaded and saved. (see 
copy systems? Direct Duplicator-1 [DD-1] and 

Relocate/Loader) 

Level 2.Contains "bad sector" errors on disk which 

prevents most commercial disk duplicators from reading 
past. Creates "shuts off in the middle of copying" 
syndrome with many disk copy programs. >Iay also contain 
LI techniques. DD-1 will copy these. 

Level 3.Same as above except program will not run 

without error sectors being put back into the copy. 
Requires Error Maker program or modification of program 
to take out sections which "look" for bad sectors. 

Level 4.This is what we will call "advanced" error 

protection. It involves altering the parameters of the 
normal drive formatting and/or writing. This will 
produce symptoms such as extra tracks, specially 
encoded data or format info, modified headers, "data 
under errors", and so on. The so called "half tracking" 
is one of these non-standard writing techniques. This 
seems to be the direction of newer software and can 
create severe compatibility problems. Diskpicker can be 
used to both analyze and develop routines to break 
anything that fits into the altered DOS category, as 
that is its primary purpose. 

Level 5.Disk requires hardware module to operate. 

"Dongle" protected. Requires Dongle synthesizer or 
modification of program so that it does not look for 
dongle. This is a "valid" form of protection if it 
allows backup disks to be made. It will minimize 
"Piracy" while giving the owner crash protection. 


This listing does not attempt to cover every 
possibility under the sun but it does cover the more 
common methods that we have encountered. For those 
levels which require modification of the program, you 
will need an understanding of how to disassemble 
programs to make the necessary changes. A full fluency 
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in machine language is beyond the scope of this book 
and really is an aquired skill. We will try to define 
the process however to give you some chance. Your own 
interest in going further is up to you. Level 4 is 
probably the one that you should avoid purchasing in 
the first place If you can find a similar program of 
similar quality without the protection. Don't be fooled 
though, a highly protected program has no relation 
whatsoever to the quality of the program. I have seen 
public domain programs that are significantly better 
than expensive commercial versions! 

Attacking level four protection can be done with 
Diskpicker. The error making and header modifying 
routines we give will get you started in this 
direction. 


— WHOLE DISK DUPLICATORS — 

Direct Duplicator-1 was written by Vic Numbers 
and is listed as a part of this book. PSIDAC holds 
copyrights on this program. DD-1 overcomes many of the 
limitations of other "whole disk" copiers. This is 
especially true for protected disks containing errors 
which will stop some copiers. Other copiers may 
attempt to "second guess" where the errors might be and 
do those sections last, which does not often work. DD- 
1 does a sector by sector duplication of every track 
and sector on the disk. It will transfer the contents 
of bad sectors but cannot reproduce an error. Most 
duplicators that can get through the errors can't 
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duplicate the errors so programs called Error Makers 
are needed. These programs and means of clearing errors 
will be described later. DD-1 has a version for single 
disk owners and a version for dual disk owners. The 
single disk version (1DUPDAC and 1PSIMAIN) will require 
swapping disks. The dual disk version (2DUPDAC and 
2PSIMAIN) is essentially a hands free system. Both 
versions will print the type of error on the screen or 
optionally to the printer/ if the original contains 
"error protection". This is a powerful feature that 
gives needed information if you have to reinstall 
errors or modify the copied program to make it run. 

One very unusual feature is a "fast write" mode 
which tests each byte of data on a sector and skips 
over any sector which contains normal format data but 
no program data. This will in no way affect the 
validity of the copy but it can cut the time to make a 
duplicate almost in half. Another really handy feature 
is the ability to write more than one copy per original 
read. The idea is that once DD-1 has read a buffer 
full of data (150 blocks) that this data can be written 
to more than one disk. This saves the extra read which 
would be redundant since the buffer still contains the 
data until a new 150 block section is read. Thus making 
many copies of the same disk can be accomplished at a 
very fast rate. This is very handy for disks of 
programs that you have written and wish to distribute. 
Generally, if the original contains more than three 
programs and you wish to make several copies, you will 
save time by using the fast write mode and multiple 
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copy features of DD-1. Since this system is written in 
machine language (DUPDAC) with a basic controller 
(PSIMAIN) speed and flexibility are natural. 

DD-1 is simple to use and usually overcomes 
protection on the original. Since the whole process is 
very direct, you will avoid spending the time required 
to get an understanding of what is being done on the 
disk. It is best for the lower levels of protection. 

There are several other noteworthy copier programs 
on the market which you might find especially suited to 
your needs. We will point out some of their advantages 
and limitations from our viewpoint. Clone Machine is 
the trade name of a set of programs released by Micro 
Ware, of Butler, New Jersey. It offers a whole disk 
backup program along with other programs similar to the 
variety we give you in chapter 6. We will cover the 
other types of tools later in this chapter. The Clone 
Machine disk duplicater program provides a "graphic" 
display indicating the reading and writing of sectors. 
The version we used locked up when an error was 
encountered. This meant writing down track and sector, 
then returning to menu options and then trying to 
continue the copy process from the point ended. We 
found this extremely cumbersome compared to the 
automatic error skipping features of DD-1. The whole 
menu process can sometimes be tedious since typically 
you will be doing the same thing over and over. It is 
tiresome having to keep telling it that you're using 
device 8 each time! 
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Clone machine uses a 120 block buffer which allows 
reasonable copy times for backup purposes. Uses for 
multiple copies or high speed are not supported, and 
copying an original with lots of protection errors 
would be frustrating. In most respects though, Clone 
Machine does what is says it will and can be useful. 
The Unguard error writer seemed to function well, it 
provides a simple direct way of writing errors back 
onto a disk. The problem will be mainly one of 
obsolecence as new forms of protection hit the shelves. 
Our biggest complaint would be the price. At $49.95 it 
is hard to justify owning for the value obtained. 

Another good copier is Supercopy by Richvale 
Telecommunications. It is relatively fast and has a 
nice menu display. Once again, the program is locked up 
giving you little opportunity to modify it and keep it 
current with the changing forms of protection. We 
believe a copy program should be open so that as new 
forms of protection come along you can add routines to 
accomodate them. 


There are several very new entries to the market 
(mid 1984) that you may wish to consider. The major 
features are that they provide fast copy times (4 
minute average) and automatic error writing including 
the "current popular errors". The copy protection used 
by these programs does indicate their inevitable 
obsolescence however. In the mean time though they are 
certainly "state-of-the-art"! Among those we have tried 


32 


finrinnnnnnriftnnnnnnnnnnnnnnonnririnnnnrinnnnnnn 





or that have come well recommended are "DI-SECTOR” from 
Starpoint Software of Gazelle, California, "GEMINI 2.0" 
available from Computron Business Systems of Portland, 
Oregon, and "ULTRA COPY" from Ultrabyte of Dearborn, 
MI. There may be more good copiers hatching than there 
are good programs to copy! 

We have included two programs which will greatly 
simplify and speed up copying disks with several 
errors. The programs are T/S Analyzer and Fastback. T/S 
is used to examine the disk sector by sector and log 
any errors found. The check is made out through 
track number 35. This log can be saved on 

another disk for later use or simply examined to see 
what you are up against. The primary purpose for the 
log is to tell Fastback which sectors to copy and which 
ones to skip. Any unused sector or a sector containing 
an error are skipped. This results in a very fast copy. 
The original time spent to make the error log is spread 
over the total number of backups that you make. 
Fastback need waste no time repeating the error 
checking on each copy as does DD-1 and most other 
copiers. Another note is that the logging routine which 
takes about 10 minutes can operate unattended unlike 
the copier programs themselves. After doing the 
Fastback you can go back with an error maker and 
replace the error sectors as needed, or remove the 
sections of the program that look for the errors. 

There are several copy programs "floating" around 
that you may run into.We have commonly found that the 
whole disk copiers usually have no fast or multiple 


33 



features and often are awkward in handling errors. 
Although DD-1 cannot solve every copy situation, we 
have tried to make it economical to own and easy to 
use. T/S Analyzer and Fastback are especially handy if 
you intend to make several backups. T/S Analyzer by 
itself is useful if you want to find out what kind of 
errors you are going to find on a particular disk. (See 
listings chapter 6 ) 

Contrary to how it may sound, a Dumb copier is 
probably the most effective way to duplicate "smart" 
protected disks. The principle of dumb copying is that 
data is fed from one drive to another without going 
through the logic of the system. This is basically a 
dubbing process. The effectiveness of protection in 
the first place relies on the fact that your disk drive 
has a computer inside that decides which data from the 
diskette is good, which is bad, and which is ugly. 
The dumb copier could care less, it writes what it 
sees! We have not heard of any system of this type yet 
on the market for low end users. We are currently 
considering developing and marketing such a system. At 
this point a lot depends on the market interest. 

— OTHER TOOLS — 

Superdirectory is what its name says it is. When 
you run into programs which cannot be copied by whole 
disk means and when you load them and they take off 
running... it's time for Superdirectory. As you know, 
the Load"$",8 tells you whats on the disk but it 
doesn't tell eveything! Superdirectory will tell you a 
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SUPERBIRECTORY 


BISK HOME = PS I PACK VI C<84:- 


TYPE 

TRACK 

SECTOR 

NAME 

ELKS 

HEX.ABB 

BEC.ABB 

PRO 

17 

0 

IPSIMAIN 

2 

0801 

2G49 

PRO 

17 

1 

2PSIMAIN 

2 

0801 

2049 

PRG 

19 

0 

SUPERBIRECTORY 

8 

0801 

2049 

F‘RG 

19 

13 

BISK-EBITOR 

7 

0801 

2049 

PRG 

17 

19 

RELOCATE/LOABER 

2 

0801 

2049 

PRG 

IS 

2 

BISKPICKER 

17 

0801 

2049 

PRG 

19 

9 

T/S ANALYZER 

8 

0801 

2049 

PRG 

17 

2 

FASTBACK 

7 

0801 

2049 

PRG 

17 

15 

1DUPBAC 

17 

C000 

49152 

PRG 

16 

7 

2BUPBAC 

17 

C000 

49152 

PRG 

2S 

2 

ABMACH 

1 

C000 

49152 

PRG 

20 

3 

MACHRELO 

1 

0348 

340 

PRG 

20 

4 

3R0MULAT0R 

4 

0A00 

2560 

PRG 

20 

6 

2R0MULAT0R 

4 

0A00 

2560 

PRG 

19 

8 

ZMACH 

1 

C000 

49152 

PRG 

20 

9 

ANALVMACH 

1 

CS40 

51264 

DEL 

20 

12 

MuNITOR$S000 

17 

0101 

257 

PRG 

19 

4 

ERROR ANALYZER 

7 

0801 

2049 

PRG 

17 

S 

20 NO HEABER 

1 

3300 

13056 

PRG 

17 

7 

21 ERASE TRK 

1 

3300 

13056 

PRG 

17 

IS 

22 NO BATA 

1 

3300 

13056 

PRG 

IS 

0 

23 DflTCHKSUM 

1 

3300 

13056 

PRG 

IS 

1 

SYNC WRITER 

1 

3300 

13056 

PRG 

17 

a 

HELP 

4 

0801 

2049 

PRG 

19 

s 

WRITE HBR 

1 

3300 

13056 

PRG 

19 

5 

REAB HBR 

1 

4300 

17152 

PRG 

19 

14 

COPY HBR 

1 

3300 

13056 

PRG 

19 

7 

CON HBR 

1 

5300 

21248 

PRG 

19 

15 

ICON HBR 

1 

5300 

21243 

PRG 

IS 

3 

LINKSTER 

5 

0801 

2049 

PRG 

14 

9 

TMRCHRELQ 

1 

1F48 

8088 

PRG 

14 

15 

TRELO 

7 

0801 

2049 
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lot about whats on your disk so that you can decide how 
to handle each program and file. 

On the opposite page is a sample printout of a 
Superdirectory listing. Note that as well as the name 
and number of blocks, you are also told the starting 
track and sector for each. Note also that DELeted 
programs are listed. Until they have actually been 
written over, they are still on the disk. This can be 
used for protection since one normally wouldn’t even 
know they were present! Appendix D shows how to restore 
scratched programs. The most valuable feature of 
Superdirectory is the second section which lists each 
program by its starting track and sector and gives the 
hex and decimal equivalents of its starting address in 
the computer. This makes it easy to separate machine 
routines from basic routines and to locate autorun and 
other protection boot systems that load in normally 
below hex 0801. With this info you can often load and 
"pick" programs separately. Without knowing these 
addresses, you can load them but you don't know where 
to find them! 

Error Analyzer has two primary functions. One is 
to do a quick track by track check for normal sync 
formatting. This is done out to track 44 so that as 
well as finding Erased tracks it will also tell you if 
anything has been put beyond the normal track ranges. 
This operation can be done in a few seconds and is a 
good idea on a new program disk to get an idea of what 
you are up against. The second mode is a sector by 
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sector check which is similar but gives you a complete 
listing of errors by sector. Unlike T/S analyzer/ this 
one does not make a log of errors for Fastback. The 
other difference is that it is a machine controlled 
read which operates OUTSIDE of the normal DOS. This 
improves its ability to "tolerate" the errors it finds 
without bumping and grinding the head in the process. 
The error listings can be printed if desired for a 
permanent record. 

Relocate/Loader is another useful tool in 
"picking" programs. For example you will probably be 
able to load and pick any program addressed above hex 
0801 but the ones starting lower than this may lock up 
the computer. The trick is to load them somewhere else 
and pick them. Once the "picking" is done, you can save 
them and change the address on the disk so that they 
load back to where they were supposed to. Somtimes 
rather than even picking a program, you may simply 
reload it so that it won't run or lock up. Then you can 
save the program - which defeats the purpose of the 
lockup anyway! The saved version of the relocated 
program will need two bytes changed on the disk so that 
it will then load back to its normal disk location and 
run normally. A 50K byte buffer is available for your 
relocated programs. All efforts were made to keep 
Relocate/loader itself small. There is also a tape 
version called Trelo which is describe# in the tape 
section of this chapter and chapter 5. 

Disk-Editor is a program that will display any 
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sector of the disk on the screen and allow you to 
change any bytes in that sector. This will give you the 
ability to change the address contained in the first 
track and sector of a program which tells where that 
program loads to in the computer. This is normally done 
on programs that have been saved with Relocate/loader 
techniques. Also you may find occasions when you would 
like to scramble some data on a particular sector, 
reactivate a deleted file or otherwise confound some 
location on a disk. Some other programs similar to this 
are called disk doctors and also have the ability to 
change data on the disk. 

Error Makers are programs which can reproduce 
certain errors on a disk. This is usually accomplished 
by sending a machine language program to the computer 
in the disk which tells it to do something outside its 
normal operating paramaters. Often there will be 
compatibility problems when using these with disks 
other than the 1541 since the operating system programs 
used by other manufacturers are not identical to the 
1541. 

Diskpicker is a disk drive software development 
system which allows you to write, load, and execute 
programs directly in the disk drive memory. We have 
provided the more commom error routines which can be 
sent to the disk drive to write the errors as desired 
on a disk. The primary purpose of Diskpicker however is 
to give you a development system on which you can 
devise your own error writing, modified formating. 
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encrypted data writing, routines and so on. As 
Diskpicker is designed, it lets you develop a routine 


such as 

an 

error 

writer. 

send 

it 

to the 

disk 

and 

execute 

it 

and 

then 

read 

the 

disk 

to see 

if 

it 

operated 

the 

way 

you 

wanted. 

Since 

the market will 


continually change with new errors and techniques for 
protection, Diskpicker gives you a way to develop and 
use new error routines as needed. Alternately, if you 
are not into machine programming, you may be able to 
find someone with an error making routine and you can 
then use Diskpicker to send it and execute it. 
Commercial error writing programs do not generally 
allow for this and are thus prematurely obsolete. The 
Diskpicker requires Monitor$8000 by Commodore to give 
it the monitor features although other monitors can be 
used by changing the auto load and monitor call 
locations. Other monitors should not be located at 
$C000 as this area is used by Diskpicker. Beyond that 
it is a unique program that gives you a chance to stay 
current in this volatile pastime. 

Linkster is a simple basic program that gives you 
a display and printout of the tracks and sectors used 
by a program. It is very handy when you need to know 
exactly which tracks and sectors are being used by any 
given program. 

There are some other tools which you may like to 
have that we have not included in our kit. Two notable 
tools are BAM view and Track and Sector display. These 
are readily available in the public domain and are 
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furnished on the demo with your 1541 drive, thus we 
have made no effort to include our own version. The Bam 
view is nice to give you a more graphical display of 
what tracks and sectors have been used on a disk. The 
track and sector display is similar to what you get 
when you use our Disk-Editor. A block at a time can be 
displayed or printed. The data is in hex with the ASCII 
representation shown off to the side. This is nice as 
it allows you to see things like names and other 
"coherent" data. It is a passive program only, and 
unlike the Disk-Editor which allows you to change 
contents of these locations. 

The next group of tools that you may need to use 
are the most powerful but also the hardest to use. They 
are the Editor/Assemblers. To the uninitiated, these 
allow you to write, view, change, save, and generally 
manipulate machine language programs. The secret that 
most programmers and pirates alike try to keep is that 
in order to become really proficient at breaking 
protected programs you need an understanding of machine 
language and the use of editor/assemblers. There are 
too many possibilities for any likelyhood of ever 
seeing an undefeatable protection breaker. Get an 
editor/assembler and start learning how to use it. You 
may never become a machine language programmer, but it 
will be a powerful tool even if your ability is 
limited. 

There are many E/As that will do the job and feel 
free to use one that you like. If you have no previous 
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experience we recommend two which Commodore sells on a 
disk called "Commodore 64 Macro Assembler Development 
System". The two programs are called "Monitor$8000" and 
"Monitor$COOO" after the hex locations in which they 
reside. We recommend these partly because the entire 
range of memory can be accessed with these two. If a 
program happens to extend up into the area used by one 
of the assemblers, you can always use the other! Also 
the command structure is identical for each which makes 
switching quite painless. Also this assembler is 
readily available . You will need it to use Diskpicker. 
There are two major weaknesses which are nearly 
unforgivable in a commercial system though. The first 
is that they will not save the memory locations where 
they reside, so you can't copy them. We have included 
a range of memory locations in Appendix B which you 
should change in Monitor$8000 so that this problem can 
be eliminated. In this manner Monitor$8000 can be 
modified so that it will save any range in memory. The 
second problem is that page zero cannot be saved or 
restored from a monitor command and thus it is awkward 
to go back and forth between basic and assembler. We 
have included a utility routine "ZMACH" that can be 
loaded when using the monitors to do this. With these 
fixes you should find them quite useful1 in attacking 
machine programs and various forms of protection. 

The use of E/As and the details of machine 
language are complete subjects in themselves. Many good 
books exist on the subject and you should purchase one 
along with the Commodore 64 Reference guide. Two books. 
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either of which will get you started on machine 
language are "Programming the 6502" by Lawrence 
Leventhal and "6502 Software Design" by Leo J. Scanlon. 
The 64 reference guide is especially important because 
of the Kernal explanations and the complete memory maps 
which can be a great aid in trying to figure out what a 
program is doing. The two 6502 machine language books 
give good expanations of machine language commands and 
simple examples of their use. Many of the routines that 
you will be disassembling involve jumps to Kernal 
routines along with specialized machine routines. By 
tracing the kernal jumps in the program you can often 
get a "skeleton" of it. By filling in with what the 
specialized machine programs are doing you can then 
learn what has been done. 

A good calculator with Hex to Decimal conversions 
is invaluable to a serious machine programmer. The 
Sharp EL-51OS is a good as well as inexpensive choice. 

— Summary — 


The simplest thing to do when first trying to back 
up a disk program is to try to make a direct whole- 
disk copy. If this copy will not run as is, you can 
then go back to see what kind of errors showed up in 
duplication. If using our copier you will already have 
a printout of this info. If you are quite certain that 
the original makes heavy use of error protection, you 
should first use Error Analyzer to check the disk out 
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and depending on what you find, perhaps run T/S 
Analyzer to get an error log. The error log should be 
saved on a disk reserved for this purpose. A Fastback 
can then be done, utilizing the error log. Next use 
an error maker to try to reproduce these kinds of 
errors in the copy. If this fails, use a program such 
as SuperDirectory to locate what kind of programs are 
on the disk and where they load to. Where possible load 
these programs and list or dissassemble them as 
appropriate for the kind of program involved. Locate 
the sections which look for the errors, extra tracks, 
etc. and take these sections out. When programs autorun 
preventing listing, use Relocate/Loader to load then 
dissassemble. For more ideas on use of these programs 
see the chapters which cover specific applications. 

If you obtain versions of the kinds of programs we 
have discussed and become proficient at using them, you 
will be able to break many forms of protection. As 
with any complex job, it is an art which depends 
largely on aquired skill. In this book we do not hope 
to solve every problem for you but rather to give you a 
guide to follow and explain the major tools and their 
use. If and when software falls into line with the rest 
of the information market, these problems of exotic 
protection may dissappear. 

— Tapes — 

Compared to disks and cartridges, tape protection 
is very easy to circumvent. The main reason for this is 
that the tape medium simply does not provide for any 
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really sophisticated "lock outs". A magnetic tape 
recorder is a very "dumb" peripheral device compared to 
a disk recorder. It contains no microprocessor or logic 
control devices which need to be fooled or bypassed as 
does a disk drive. The serial nature of the tape does 
not allow for sophisticated file handling and the 
kinds of access code checking that disks may use. In 
fact, if a program of interest is available both on 
disk or tape, you may choose to purchase the tape and 
make your back-ups on disk! You can then enjoy the 
speed and versatility of the disk while avoiding the 
sophisticated forms of protection which the disk 
version may contain! 

The most effective way of copying a taped program 
is to use the "Clone" method which we describe in 
chapter 5. The effectiveness of this system is due to 
the fact that it is an entirely "dumb copier". A dumb 
copier makes no attempt to interpret any data, it has 
no means to do so. Information coming from one 
datasette is rerouted via a special plug and fed into 
another datasette. One plays whatever is on the tape 
while the other records whatever is on the tape. The 
data on* the backup is an exact match to the original 
complete with any protection and so on. 

When using cloning for duplication you should be 
aware of the fact that a cloned copy is never quite as 
good as a "computer saved" copy. The amount of 
degradation is minimal and will not cause any problems 
if the clone is made from an original tape. If clones 
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are made of clones, there will be a multiplication 
effect so that after about four or five generations the 
copy would be unuseable. You might think of this as 
sort of a problem of inbreeding. The best practice is 
to clone the original and use the clone, keeping the 
original stored safely away in case your clone is 
damaged. In this manner all clones will be first 
generation and will not exhibit mutant tendencies! 

Another way to make tape copies is to try to save 
them directly. One noteworthy form of tape protection 
against this relies on an autorun routine in the 
program. These are loaded below hex $0801 in memory. 
The usual trick is to use a short autorun program which 
also disables the STOP key so that you cannot break and 
list the main program(s). Often there may be more than 
one program, each of which can be loaded and saved 
normally as long as the autorun section is not loaded. 
If the datasette runs and stops and runs again while 
loading a program, this is probably the case. The 
autorun section can be saved separately by using the 
tape version of Relocate/Loader, Trelo. 

If you decide to try to copy tape programs by 
loading and saving, you will need to know whether they 
are basic or machine language and where the machine 
sections reside in memory. Chapter 3 details the tape 
buffer which can be used to extract the beginning and 
ending addresses of programs being loaded. In order to 
be effective at this kind of work we recommend that you 
add a "Load Data Audio" circuit to your computer. Tape 
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programs contain a "header” section which contains the 
name and locations* By listening to the program load 
with the audio circuit, you can stop the recorder at 
the appropriate times and Peek at the tape buffer to 
find out the starting and ending locations. An 
editor/assembler is helpful in this also so that you 
can get a full hex display of the important buffer 
locations and also directly save the machine programs 
to the backup tape or disk. 

This completes our discussion of tools for 
duplicating software. Although other tools and methods 
exist, this is a good sampling of the essentials. As 
with any craft, you will probably find yourself 
collecting a variety of specialized tools to solve 
special problems. As your skill with the simple tools 
increases, you will begin to understand the 
applications for the more advanced tools. 
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*** CHAPTER THREE *** 


MAPS 


For many applications of the computer we do not 
need to know much about the memory of the system. 
Usually we can be happy knowing that we will not run 
out of useable memory space. When it comes to 
duplicating programs however, working without a memory 
map is like trying to find a house in a strange city 
without a roadmap. "Getting into" a protected program 
will often require that we know something about where 
it normally resides in memory or how the computer is 
configured to run that program. This chapter will give 
you the maps and information about system configuration 
that you will need. This chapter should be used as a 
reference when you get into situations which reguire 
you to locate programs. Do not worry about memorizing 
this information, you will be better off just 
familiarizing yourself with what kind of information is 
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here, then look it up when you need it. 

We will cover five topics concerning memory as 
follows: 

1. Normal configuration. 

2. Software reconfiguration. 

3. Hardware reconfiguration. 

4. Special locations. 

5. Disk memory. 


NORMAL CONFIGURATION 

Figure 3.1 shows the normal configuration for the 
C64. Note that the memory addresses are given both in 
hex and in decimal. In this configuration the areas 
shown shaded are RAM available to the user. For basic 
programs the memory must be contiguous. Thus the 
area from 2048 to 40960 (38911 bytes) is available for 
basic programs. 

Basic ROM starts at $A000 and extends to $BFFF. 
That means that in normal configuration, this area is 
occupied by Basic and cannot be used otherwise. Another 
free RAM zone begins at $C000 but can only be used for 
machine programs or data storage kinds of jobs since it 
is not contiguous with the other free RAM. The area at 
$C000 is 4K (4096) bytes, extending to $CFFF• A basic 
program can poke values to the 4K RAM at $C000 thus 
increasing the available RAM without reconfiguring. 
Alternately, this RAM at $C000 could be used for 
machine subroutines which basic could call thus 
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reducing the requirements for uninterupted 
space. 


memory 
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SOFTWARE RECONFIGURATION 


One of the unique features of the C64 is the way 
its memory can be reconfigured. This is made possible 
because the C64 contains 64K of RAM located between hex 
$0000 and $FFFF. The ROM and I/O areas shown on figure 
3.1 actually contain RAM "underneath” them. The 6510 
microprocessor used in the C64 allows the programmer to 
switch memory blocks in or out. If the 6510 
microprocessor chip had more than 16 address lines, 
the process of reconfiguring memory would not be 
necessary. The 16 address lines limit it to directly 
addressing 64K of memory. By using a special output 
port at location $0001, the 6510 "turns on or off” 
these memory blocks which are addressed "on top of each 
other". Actually, the ROM and I/O are normally "in", 
while the RAM underneath is accessed by switching the 
ROM "out". So Basic ROM is normally seen at $A000 and 
KERNAL ROM is normally seen at $E000. The I/O section 
hex $D000 to $DFFF has three possible memories to talk 
to. Normally it is I/O. By changing location 1 to a 
value such as decimal 51, the character ROM can be 
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switched into the D000 to DFFF locations, A value of 
decimal 48 will switch the D000 to DFFF RAM in. 

In the case of BASIC and KERNAL areas, the 
underlying RAM can be written to at any time but can 
only be read if the ROM is switched out. Thus a basic 
program can poke values into these "hidden" RAM 
locations or a machine program can Store to these 
locations. To read the contents of this memory the ROM 
must be switched out by the accessing program. This 
means that the program that reads these locations 
cannot be BASIC because the BASIC ROM and/or KERNAL 
ROM will be "shut off" during the access time. For 
example, if the KERNAL area is "off" the machine 

routine must not access KERNAL routines during the time 
the hidden memory is being read. If Basic is off, the 
calling routine must not use any basic statements. One 
important note is that switching the KERNAL off also 
disables Basic. Also if using the I/O area, the program 
reading the underlying RAM must not contain any 
interrupts, keyboard or I/O calls, in addition to not 
using BASIC or KERNAL routines. Outside of these 
limitations, the memory reconfiguration is a good 
feature which allows the C64 to go far beyond the 
limitations of a normal 8/16 bit computer. 
Unfortunately, it also makes for quite a bit of 
confusion for many users and makes some forms of 
protection harder to analyze and break. In some cases, 
knowing the normal configuration for a program you are 
trying to break will be of paramount importance. 
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Three of the bits at location $0001 hex control 
the configuration of the ROM and I/O memory. Table 3.1 
shows the hex, binary and decimal values used to 
reconfigure the port. Most often you would use a small 
machine routine to set the value at location $0001 for 
the configuration desired, then access the memory, 
finally resetting the value at $0001 to 37 before 
returning to basic or accessing normal I/O or KERNAL 
routines. 


TABLE 3.1 


Value 

at Loc $0001 



HEX 

BINARY 

DEC 

CONFIGURATION 

37 

110111 

55 

Normal (Map fig 3.1) 

36 

110110 

54 

BASIC out 

35 

110101 

53 

KERNAL & BASIC out 

34 

110100 

52 

BAS -KERN -I/O out (64K RAM) 

33 

110011 

51 

I/O out 

32 

110010 

50 

I/O & BASIC out 

31 

110001 

49 

I/O & KERNAL & BASIC out 

30 

110000 

48 

1/0-BAS -KERN out (64K RAM) 


Although the values in table 3.1 are the "normal" 
state for the data in location $0001, there are other 
situations which may cause these values to appear 
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different than the ones listed in table 3.1. The reason 
for this is that the value at location $0001 is the 
result of eight bits of binary information and only the 
last three of these bits actually control memory 
configuration. The other bits which go together to make 
up the value have to do with the cassette port. Simply 
storing one of the hex values listed in location $0001 
will achieve the desired result but is not the 
"cleanest" in programming terms. A better method when 
you need to shut OFF one bit of eight, is to use the 
logical AND instruction. When you need to turn ON one 
bit without affecting the rest, the ORA (logical OR) 
instruction is best. Table 3.2 gives the pre¬ 
calculated values to AND or OR for changing memory 
configurations. Think of the AND as disabling certain 
ROMs while the OR (ORA machine) will reset to normal. A 
disable program for removing basic might look like 
this: 

LDA #$FE 
AND $01 
STA $01 
RTS 

A resetting routine: 

LDA #$01 
ORA $01 
STA $01 
RTS 
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TABLE 3.2 



Disable # 

(AND) 




HEX 

Enable # (OR) 
HEX 

Configuration 

2- 

FE 

01 

Basic out 

3- 

FD 

02 

KERN & BASIC out 

4- 

FC 

03 

KERN BAS I/O out 

5- 

FB 

04 

I/O out 

6- 

FA 

05 

I/O BAS out 

7- 

F9 

06 

I/O BAS KERN out 

8- 

F8 

07 

I/O BAS KERN out 


HARDWARE RECONFIGURATION 
(CARTRIDGES) 

As you can see, the useable memory controlled by 
the addressing limitations of an 8/16 bit 
microprocessor/ is pretty well filled up! The problem 
then arises of where to put cartridge programs. Leaving 
a certain area unused as the VIC 20 does, would mean a 
limitation of user RAM or a tradeoff in sophistication 
of the normal system. Rather than allow this, the 
Commodore designers included another memory 
reconfiguration scheme that could be controlled by the 
cartridge itself. The concept being that cartridge 
programs would occupy RAM locations starting at hex 
8000 or hex A000, with a hardware system of switching 
out the normal memory in these locations. This still 
leaves a lot of RAM available if needed by the 
cartridge program and, in the case of A000 cartridges, 
uses BASIC area which is not often needed 
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cartridges are machine language. 

An interesting fact is that the cartridge program 
could again reconfigure memory once it starts 
operation. In many cases this would foil attempts to 
transfer the cartridge program to RAM inside the C64 
and running it from there. Some cartridge programs can 
be operated from C64 memory without using the 
cartridge! This is not a very predictable method though 
as even a simple "write over” loop in the program could 
eliminate any possibility of running in RAM without 
write protection. This along with the chance that the 
program could reconfigure memory when it runs, 
convinced us that the only viable way of running 
cartridge programs without using the cartridge would be 
through the use of an external RAM with write protect 
capability, which essentially emulates ROM. Thus the 
Romulator system described in chapter seven provides a 
very reliable cartridge elimination scheme. 

The hardware reconfiguration necessary for the 
cartridges involves two lines which are connected to 
the expansion port of your C64. These two lines are 
named GAME and EXROM and they are normally at logic one 
with no cartridge plugged in. In general, these lines 
are either individually or both grounded by the 
cartridge to control the memory configuration of the 
C64. Table 3.3 details the possible combinations of 
these lines and indicates what areas are made 
available. Actually there is no specific rule for 
exactly where in these areas a cartridge must start for 
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any given line configuration. However unfortunate this 
might be, it has little effect on our ability to copy 
and operate the cartridge in external RAM such as the 
Romulator system does. All that is important is that 
you know the normal state of these lines with the 
particular cartridge in question. Chapter seven 
outlines a very simple non-destructive way to find out 
the normal starting location used by the cartridge ROM. 


TABLE 3.3 


GAME 

EXROM 

MEMORY CONFIGURATION 

1 

1 

NORMAL- no cartridge in 

0 

1 

$8000 & A000 & E000 available 

1 

0 

Location $8000 available 

0 

0 

BASIC out $8000 & $A000 available 


Hardware reconfiguration will be needed if you are 
doing cartridge backups. The Romulator system provides 
you with the necessary hardware to accomplish this for 
the majority of 8K and 16K cartridges currently 
available. 

- SPECIAL LOCATIONS - 

There are several areas in the C64 memory that are 
of particular concern to anyone breaking protected 
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programs. These locations or areas of memory either 
contain information that you may need to duplicate a 
particular protected program, or they may be locations 
used for purposes of disabling the keyboard, auto¬ 
start routines and so on. One area of especial interest 
is the "control zone” which is indicated on figure 3.1. 
This zone which resides between $0000 and $0400 is 
mainly used by the operating system to store 
"housekeeping” data such as pointers, vectors, flags 
and so on. The "zero page" ($0000 to 00FF" is located 
in this zone. The memory maps in the Commodore 64 
Programmer's Reference Guide spells out the function of 
every assigned location in the control zone. There are 
three fairly good size "free" areas within the control 
zone that you need to be aware of. The tape buffer 
$033C-$03FB is one and an unused area $02A7-$02FF is 
the other and $0100-$0IFF the third. Although the tape 
buffer area and the $0100 area have other jobs, you 
will see them used for directly loaded routines. 

The tape buffer has two characteristics of 
interest to us. One is that upon loading a tape header 
from a program, it will contain the starting and ending 
addresses of that program. Figure 3.2 shows the first 
few locations of the tape buffer and indicates what 
information the bytes located.there contain. Note the 
way the starting and ending address of the program that 
has been loaded is determined. Second, the buffer area 
of the tape buffer is often used for a short control 
program or data storage. Programs in the buffer area 
can be written there from disk or tape or sometimes 
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placed there via a "poking” routine in another 
location. Since this area would only be affected by a 
tape load, it is protected from being destroyed by 
normal means such as resets etc. Also it is not obvious 
to the uninitiated and thus provides a small measure of 
secrecy. Routines here must be in machine language as 
it is not contiguous with user RAM. The size limits the 
extent of the program, but it is perfect for boot or 
protection routines and access codes. 

The unused memory at $02A7-$02FF has similar 
applications. This is an insidious area because it 
borders on the BASIC vector locations. The significance 
of this is that if each of these five vector locations 
contain the starting address of a routine, any 
RUN/RESTORE attempt will force an automatic jump into 
the routine. In this manner, an attempt to break a 
program for listing or disassembly cannot be done from 
the keyboard. Most importantly* though is that if these 
vector locations are loaded to from tape or disk, upon 
completion of the load the program they point to will 
run! This is the elusive method for AUTORUN! The trick 
to using autorun is that the program must be in the 
computer BEFORE these locations are loaded to. Since 
one of the purposes of autorun is to prevent listing of 
programs before the user RUNs them, that means that the 
program to be autorun must be loaded along with but 
before the vectors. The only area before the vectors 
big enough to contain a program is the $02A7 to $02FF 
area. Although not large this area is perfect to boot 
ana main program and run it. RUN/RESTORE will simply 
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restart the program as long as the vectors are set! The 
Relocate/loader process in chapter six gives the 
procedure to get around this and save these routines or 
examine them. Appendix C lists an autorun routine that 
you can use with your own programs if you wish. Note 
locations specified for addresses and load options. 

The zone at $0100 has sometimes been used for 
autorun boots. Most of the same ideas apply to it as 
the other areas we have already talked about. You 
should once again be alert for addresses shown up by 
Superdirectory which reside in this zone. The 
Relocate/loader is a • perfect way to save these 
routines. 

As usual, the possibilites for using or modifying 
certain locations in the control zone are limitless. 
Ultimately, you need the ability to find out what 
locations a program is using in the control zone and 
then analyzing the result for each particular case. 

Some programs, especially basic will need to have 
the basic vector locations intact, that is the 
autostart method would interfere with the normal 
operation of a basic routine. When this case occurs, 
the autostart may be used as a loader but from the 
moment the basic program is accessed, the five vectors 
will need to be restored. There is a method which will 
prevent any basic program from being "Stopped" and 
listed which requires no special separate routines. 
That is to execute a POKE808,225 somewhere near the 
beginning of the program. This location is the KERNAL 
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STOP routine vector 


and poking 225 there prevents the 
computer from doing the STOP routine when the STOP key 
is pressed! 

As a general rule you should be especially 
watchful of pokes or stores to any control page 
locations. Pay particular attention to any changes of 
vector addresses as they cause the computer to go to 
the wrong place when that routine or condition arises. 
This allows protectors to keep people from using 
"normal" means to look at their programs. For more 
information, you will need the 'Programmers Reference 
Guide or-one of the other clones of this guide which 
fill most bookstore computer bookshelves. Probably the 
most fertile range to study and look for in programs 
are address locations $02A7 through $03FF. This range 
contains the five BASIC vectors and thirteen KERNAL 
vectors as well as the largest unused zone and the 
tape buffer. 

The tools included in this book are just the 
beginning in breaking protection. The whole protection 
dilemma is dynamic in nature and even as we write this 
book, someone somewhere is bound to be devising a new 
and more diabolical scheme. Every time you buy another 
utility guaranteed to break "all forms of protection" 
you will eventually find something it won't work on. 
Information and understanding are the most important 
keys you can have to unlocking protection. 

- disk MEMORY - 
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Perhaps one of the best kept secrets of the 
Commodore family of equipment is information concerning 
the disk drive. Most of the information around is a 
slightly fermented product of the grapevine... So and 
so said this... what'isname said that. The information 
and procedures being used with the disk range from 
gibberish to genius. What we have managed to distill 
from all this is somewhere between and although I know 
it is not genius, I hope you won't find it gibberish! 

In this section ye will give you a simplified disk 
map, figure 3.3 as well as point out a few of the areas 
of special interest. The VIAs which are used in the 
disk drive are detailed in figure 3.4. * For diskette 
formatting, we will refer you to your User's Manual. 
Appendix F shows a GCR (group coded recording) map of a 
typical disk sector. You should also note the GCR 
header organization as it is slightly different from 
what the disk manual implies. The rest of this chapter 
will explain the areas shown on the maps in figure 3.3 
and 3.4. 

The ROM used in the disk is 16K and provides a 
unique operating system (DOS) in which the vast 
majority of all disk functions are accomplished by 
software. This is the hardware-software tradeoff which 
gives designers the choice of making fast and 
relatively expensive hardware intensive products 
versus slower, cheaper software intensive products. 
The Commodore directive was to produce an inexpensive 
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disk which inherently requires the use of software for 
as many functions as possible. Although much too long 
to detail here, you can get a complete disassembly of 
this ROM by using Diskpicker which is explained in more 
detail in chapter six. If you are serious about 
programming the disk, you should take the time to do 
this. Be sure to have lots of paper ready for your 
printer and a couple hours of time. 16K is a lot to 
transfer and print! 

As a user, you can control the ROM only to the 
extent that you may use (JSR to) the routines contained 
there. However, those with the knowlege and equipment, 
could "burn" another set of ROMs with some of the 
routines specially modified. The purpose of this might 
then be to cause the disk to write in an abnormal 
manner which could not be reproduced by normal disk 
drives. If this is done in a manner that does not 
interfere with normal reading operations, it would be a 
very effective protection scheme. The users "normal" 
operating system could not copy or write in the same 
way as the manufacturers "abnormal" operating system. 
The only hope would be if the user, by analyzing the 
protection, could write a routine that could be fitted 
into an unused RAM buffer in the disk memory. In some 
cases, one could reproduce the way the disk was 
protected. This is one of the primary purposes of 
Diskpicker? to allow user machine language programs to 
be developed, tested, and operated in the disk RAM. 
The major problem in implementing such routines will be 
the limited RAM available. If the protection DOS 
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routine is called by an earlier DOS routine, the users 
RAM routine would need both, as well as any others in 
the chain. The whole thing starts to become quite 
large. The reason is that the normal DOS is going to 
call routines within its address space, this does not 
always allow jumping out to RAM routines then back and 
so on. Only a modified ROM could provide this 
capability. There are still many routines you can use 
parts of from RAM calls however. As chapter six will 
show you, our error writing routines involve exactly 
this kind of process. 

The ROM area from $C000 to $F24C serves mostly 
for the software oriented tasks of interpreting, 
manipulating data and so on. This you will probably not 
have a lot of reason to modify. The ROM from $F24D to 
$FFFF contains the hardware control routines. These 
routines control such things as selecting tracks and 
sectors, starting motors, selecting reading and writing 
and so on. Many of the error writing jobs can be 
accomplished by using these routines or modified 
versions of them. A source code listing, which you may 
be able to locate through a user group, can be an 
invaluable aid in using these routines. 

The RAM used, by the disk is 2K in size. The RAM 
provides the zero page ($0000-$00FF) which is required 
by 6502 based systems. Two pages $0100-$02FF are 
reserved for additional pointers, stack requirements, 
and so on. $025B-$02B0 which is in this area is used 
for RAM array and takes care of file handling. $02bl- 
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$02FF is for output buffer information such as error 
codes and directory. The rest of the RAM area is 
divided into 256 byte "buffers”. There are five of 
these buffers which have the primary job of holding the 
data comming from and going to the disk. They are 
allocated as needed by the DOS. User programs can be 
located in these buffers and called by the user 
commands. The first 18 bytes of the buffer at $0500 are 
often used ‘for a jump table to user routines. 

By far the most important area of these RAM 
locations is the $0000-$0005 which is the job queue, 
and $0006-$0012 which provides the respective headers 
(track and sector) for the job in the queue. Note that 
there are two RAM locations for each job location. 

In addition to the ROM and RAM, there are also two 
Versatile Interface adapters which are seen by the disk 
CPU as memory locations. By nature, a VIA occupies only 
16 memory locations. Figure 3.4 shows what is found at 
each location of a VIA. The first VIA is normally 
"seen" at $1800-$180F. Its primary job is to control 
the serial bus. It is connected directly to the serial 
bus and has the job of taking data from, the internal 
data bus and sending it out on the serial bus and vice 
versa. The second VIA is normally "seen" at $1C00- 
$1C0F and its job is to serve as hardware controller. 
It is connected to the circuits which drive the motors, 
sense write protect, and controls the read/write logic 
for the head. The hardware signals are transmitted to 
and from the VIA directly from the internal disk data 
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FIGURE 3.4 
1541 DISK VIA MAP 


00 

I/O REGISTER B 

01 

I/O HEGISTER A (WITH HANDSHAKE) 

02 

DATA DIRECTION REGISTER B (OOR-B) 

03 

DATA DIRECTION REGISTER A (DDR-A) 

04 

TIMER ONE LOW BYTE (CLRS INT ON READ) 

05 

TIMER ONE HIGH BYTE (CLRS INT ON WRITE) 

06 

TIMER ONE LOW BYTE TO LOAD 

07 

TIMER ONE HIGH BYTE TO LOAD 

08 

TIMER TWO LOW BYTE 

09 

TIMER TWO HIGH BYTE 

OA 

SHIFT REGISTER 

OB 

AUXILIARY CONTROL REGISTER (ACR) 

OC 

PERIPHERAL CONTROL REGISTER (PCR) 

OD 

INTERRUPT FLAG REGISTER (IFR) 

OE 

INTERRUPT ENABLE REGISTER (IER) 

OF 

I/O REGISTER A (WITHOUT HANDSHAKE) 


The 1541 drive uses two VIAs. One is primarily used in 
communicating with the serial bus while the other is 
primarily used For hardware control. The VIA occupies 
16 memory locations (00-0F). The specific Function 
desired can be accessed at one of these locations as 
indicated. Note that either VIA can be READ From or 
WRITTEN to, thus a port would be an input if it is 
being READ and an output if it is being WRITTEN to. 
This is taken care of with the normal READ/WRITE 
control line From the microprocessor. 
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bus. As you can see from figure 3.4, among the other 
functions/ the VIAs have directly addressable timers 
which are used as needed by the DOS. 

One interesting fact about the 1541 drive is the 
"mirroring" of memory that is shown on the map figure 
3.3. As shown # the deviccss which make up the disk 
memory can be seen at more than one location in the 
map. The ROM at two 16K areas, the RAM at four 2K 
locations/ and each VIA at 256 16 byte locations (not 
shown). The reason for this is the way the disk 
hardware decodes memory. It was simply cheaper and 
easier to decode only the necessary address lines to 
place the memory in its designed locations. When only 
some of the address lines are decoded to define a 
memory block, that block will be "mirrored" at every 
other location defined by those lines. In order to get 
unique positions in memory/ all address lines must be 
decoded. Mirroring causes no problems so long as two 
decoded blocks do not overlap each other. It can 
produce some confusion though if you are not aware of 
it and you "discover" what looks like important data at 
say $2003. What you would be seeing is actually the 
zero page data at $0003! A programmer could confuse 
those studying his code by accessing the same data with 
different addresses. 

Other sources for information on the disk include 
the 1541 Maintenance Manual by Michael Peltier, which 
covers the system hardware if you need to make repairs. 
You will not find it much help for software 
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applications though. The User's Manual that comes with 
the drive should be refered to for diagrams on how the 
diskette is configured with tracks and sectors. However 
note appendix F for the correct header format map. One 
final interesting note is that the drive can be forced 
beyond track 35 by software control. Chapter six covers 
this in detail. 
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*** CHAPTER FOUR *** 


PROTECTION CONCEPTS 


Software protection concepts have evolved from 
relatively simple schemes to very complex ones. In the 
rush to find ways to keep users out of programs, 
methods have been developed at an incredible pace. Each 
new form of protection then spawns a whole new set of 
breaker programs and copying technigues. The results of 
this vicious cycle takes its toll on programmers AND 
users. If you have been playing in this game for even a 
short time you have perhaps already bought some breaker 
products only to find that some new form of protection 
foils the methods it uses. So once again you are in the 
market for the latest breaker system and so on and so 
on.... We cannot offer a total solution to this nor I 
doubt, can anyone else. The ultimate answer for disks 
will probably take the form of a mechanical "dumb 
copier" which will not interpret any data but simply 
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read and write an exact copy. Although it still 
wouldn't be a guarantee against certain forms of 
protection. This chapter will cover a variety of the 
techniques currently being used. Chapters five six and 
seven will then list specific procedures. Your ability 
to stay current with the ever changing techniques 
depends on your practice and motivation. We will start 
off with information about disk then go on to 
cartridge and finally tape protection methods. 

There are really two things to consider when 
breaking protection. One is; do you just need a copy?, 
and two is do you need to modify the program (code) to 
customize it for your application? Where applicable we 
will try to include information to help you get 
listings of protected programs. Often you can learn 
quite a bit by studying listings of protected programs. 
In many cases, modifying the program so that the 
protection no longer exists will give you a much more 
valuable commodity. With your modified version, you 
won't have to play all the protection games if you need 
an additional backup copy! 

- DISK PROTECTION - 


Chapter two defined some arbitrary levels of 
protection. Here we will expand on this information 
giving you more detail on the protection in contrast 
with our earlier focus on tools available for breaking 
the various levels. 
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LEVEL 0.... Although this level is "unprotected" 
there are a few points that a beginner should be aware 
of. If the program is in Basic, it may involve more 
than one program which the user would need to copy 
separately. Since these are often chain loaded, it is 
important not to run the program. It should be loaded, 
saved to the backup then perhaps run to see if it loads 
any other programs. In a similar fashion, the program 
might access data files which would not be saved by the 
save command. Often the program might • be in machine 
language and a simple save will not work since that is 
for basic only. Even though the machine routines are 
"unprotected", you may need to use something like 
Superdirectory to find the address range of the program 
so that you can save it with an Editor/Assembler. The 
E/A's require that you know the beginning and ending 
address of the program to save it. In general, with 
unprotected programs, if you wish to copy by Saving you 
need to know the details of what kind of program it is 
and what all it needs to operate correctly. The 
simplest method of duplicating such programs is to use 
a BAM type copier. Virtually any whole disk copier 
will also work. 

LEVEL 1.... Programs in this category use some 
sort of autorun feature which prevents the user from 
making listings, and directly Saving the program. The 
added use of a STOP disable poke keeps the user from 
simply pressing the stop key to see whats in the 
program. On programs that ask for data from the 
keyboard or use a peripheral device, you can sometimes 
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break into them by giving the computer some value out 
of range or unplugging the device the program is 
talking to. The idea is to force some kind of error 
which will return control to the user. At that point 
listings etc can be done. Usually the program will 
intercept the error codes and return control to the 
program, so you will need to be devious in the kinds of 
things you try. We were able to break into a well 
protected word processor and generate complete listings 
by unplugging the cassette connector while the program 
was writing a file. Other ways to get into such 
programs involve more coherent means such as 
relocate/loading which prevents autoruns as the data 
does not go into the vector table that the programmer 
wanted. Then by saving the program without the autorun 
or with a modified autorun, the disk can be edited so 
that when the copy is loaded it goes to the right place 
but no longer has the protection! The complete 
procedure for this is in chapter six. Once again if 
making a backup is your only concern and you do not 
need to get into the code, you can use BAM copiers or 
whole disk copiers. The advantage of relocate/loading 
is that in essence it gives you a new unprotected 
program which you can list and modify at will. The BAM 
and whole disk copiers will give you a "clone" of the 
original which will still contain the autorun and non- 
STOP features as originally written. The final choice 
depends on your needs. 

LEVEL 2.... has been defined as including those 
programs which use disk errors to stop whole disk 
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duplication. In this case, the errors will only stop 
duplicators which do not reset or "handle" errors. 
Although "old" as the protection methods go, there are 
several "whole disk" duplicator programs which will 
stop if the disk indicates that there is an error on 
the disk. The kind of error could be one of many 
possibilities but generally falls into the category of 
tampered headers or data on the disk. Regardless of the 
specific error, the duplicator stops because the disk 
drive tells the computer in essence that the diskette 
is defective. This of course is exactly what the 
protectors want to happen so that you will not get a 
useable copy. Most of the more recent entries on the 
duplicator market can handle this kind of error 
situation. There are various possibilities but the 
concept is to "skip over" any sector in which the disk 
drive sees an error. Some such as DD-1 will go ahead 
and transmit the data on the sector in question in many 
cases. Essentially it just ignores the errors that the 
disk drive says are there, and goes on to the next 
sector. This level of protection can be broken by error 
tolerant duplicators. Alternately, the relocate/load 
method can be used on this protection level. This 
level of protection usually includes the autorun and 
non-STOP features. Otherwise there would be nothing 
stopping the user from simply loading and saving the 
program. The program itself has no relation to the 
errors, they are just inserted on a blank track or 
sector to disable copiers which don't have error 
tolerant routines. 
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LEVEL 3.... This level is more typical of much 
current software. In this elaborate scheme, disks will 
have errors and autoruns as described earlier but to 
complicate matters, the program or a loader will check 
to see if the errors are present at the right locations 
on the disk. If the errors are not there, the program 
will not run, or it will crash. This is called error 
checking and if a program employs error checking you 
will need to either get rid of the error checking 
routines or you will need to put the same errors back 
on the backup disk as the original had (and in the 
correct places). One popular place to put the error 
checking routines is in a loader that runs after the 
autorun boot has started things up. The order is 
something like this: A very small autorun routine loads 
to the control zone resetting vectors and forcing 
itself to run. This autorun then boots in a loader 
program which is more sophisticated and handles the 
loading and error checking for the main disk 
program(s). If the loader doesn't find the proper 
errors in the correct locations it will not continue to 
load the main program or will cause a crash etc. In 
addition to checking for the errors, the loader program 
may be responsible for actually deciding which tracks 
and sectors to load and in what order. This way a main 
program can be saved and have its BAM erased. As long 
as the person who writes the loader knows which order 
the tracks and sectors need to be loaded. Interspersed 
amongst the valid data loads the loader can check 
predefined tracks and sectors for specific errors. By 
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using a table of tracks to load and ones to error 
check, a very high degree of protection is obtained. 
Our disk analyzer is helpful both in making protected 
programs and backing up ones that have been protected 
in this manner. It will give you a sector by sector 
list of which ones contain data and which ones contain 
errors as well as what kind of error. When the main 
program has finally loaded correctly, it will run 
taking control of the system preventing breaks or 
normal methods of stopping. The main program may or may 
not perform further checks for errors on tracks and 
sectors depending on how it is designed. The simplest 
approach for these programs is to use an error 
analyzing routine and whole disk copier and then use an 
error writer to make errors on the backup - exactly 
like they were on the original. The major problem with 
this is keeping up to date on the errors that you can 
write onto your backup disk. As the state of the art 
progresses, you find that you need to be able to write 
an increasingly large number of different kinds of 
errors. The other method which is harder is to 
relocate/load and disassemble the loader routines and 
locate error checking sections. Again, the disk 
analyzer printout will help because it will tell you 
which sectors contain errors. Upon inspection of the 
loader you will know which sectors it is expecting to 
find errors in and spotting that data is easier. With 
the "Hunt" command of an editor/assembler you can 
systematically search through large amounts of code to 
locate occurances of likely command sequences. Practice 
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and experience are the key to doing this successfully. ^ 

In general you will be looking for a sequence of CMP #$XX q 
(XX= hex error code value) followed by a BEQ or maybe £ 

BNP'* *. C 

c 

The error writing process itself involes a fairly C 

. r 

cumbersome system of writing special routines which are v 

loaded into the disk drive RAM and executed by the disk ^ 

drive microprocessor. The routines are basically mutant £ 

versions of the disks own formatting and data writing C 

c 

routines. In other words, if you have just saved a v - 

program which you wish to protect by these means (or 
made a backup which needs them), by running one of £ 

these mutated routines, you can cause something like C 

f 

one sector header to be formatted differently than the 

C 

normal pattern for that disk. Other possibilities ^ 

include erasing an entire track of data or completely £ 

wiping out a sector. C 

c 

The level three will at some point check to see if C 

errors are present before a run will be allowed. ^ 

. . c 

Alternately the errors might be checked within the 

<L 

program. £ 

c 

LEVEL 4.... This in many ways is just an extension ^ 

of Level 3 but there is a sly twist. The errors £ 

involved in this level of protection include with the C 

others, the trick of putting data beyond the normal 35 ^ 

o 

tracks defined in the original drive design, or writing q 

data where none would be expected and can't be 
recovered by the DOS read functions. Both the extra C 

tracks and the "hidden” data require modified DOS ^ 

C 1 
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routines to be loaded. These DOS routines are machine 
programs that operate similar to the normal ones in the 
disk but they are designed to find the hidden data 
whereas the normal routines would simply return an 
error. The "extra track" protection could involve 
simply writing sync beyond track 35 or even go as far 
as putting data out there. There are other unexpected 
places to "hide" data such as between the last and 
first sector of any given track. This area is normally 
defined as a "gap", but data can be written and read 
here using modified DOS routines. Another trick is to 
erase all or part of a track and then to write data in 
the erased part. This data will not have the usual 
headers, so it must be read with a special routine. One 
way to find such data is to find the last valid sector 
using an error analyzer, then begin reading the data 
found AFTER this block. In this manner you can recover 
a couple of sectors worth of the hidden data. This 
process can be repeated with a change in the timing so 
that you see more and more of the data. Often a couple 
blocks worth is all you need. The diskpicker HDR read 
routine is useful for this purpose. Changing the sector 
number to an illegal value has a similar effect to 
these others. The disk may only expect to find perhaps 
.20 sectors on a given track but the protected disk will 
have some sectors with numbers higher than this. To 
recover this data, you would again go to a header 
reading routine. In essence, you will get the data 
First, then save it under a valid number. The last 
thing would be to change the copy header so that it 
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looked like the original. Errors can be "spliced" into 
a copy disk by reading the bad part off the original 
and writing it verbatim to the copy. (See Diskpicker 
Procedure) 

Once again though, in these processes the drive is 
being manipulated by mutant programs to perform these 
"unnatural acts". We discourage both the use and 
purchase of software with this form of protection as 
there are some valid questions as to the effects this 
can have on a drive. First of all, there are many 
1541s, especially the earlier models, which seem to get 
out of align if the head is forced to "bump" 
excessively. (Bumping is when the head goes to the end 
and bumps several times) These programs only aggravate- 
this situation as you may have already discovered. A 
good quality drive mechanism should be able to handle 
this without problems but this problem does exist and 
will occur on some drives. You will just have to live 
with it if you decide to purchase a program with such 
protection and it adversely affects your drive. In the 
least these programs will usually take their time 
loading with a undue share of bumping, chattering, 
blinking, and various other assorted paranormal 
responses. 

Another dilemma with this level of protection is 
that it may not be compatible with drives of other 
manufacturers. How a drive loads and saves data is a 
function of the hardware and software design of the 
drive. When a drive is as software dependant as 
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Commodore's are, a 100% compatible drive would have to 
have the disk operating system copied verbatim. 
Although this has been done before with some computers, 
it is legally questionable. It is generally accepted 
that totally compatible means 99% compatible while most 
"compatible" equipment really comes in at a much lower 
percentage. What is reasonable to expect is that a 
compatible disk drive can save and load it's own 
programs and load commercial software that is recorded 
WITHIN ORIGINAL EQUIPMENT MANUFACTURERS SPECIFICATIONS. 
With level 4 software the protection is not within the 
design parameters of the drive so it is anybodies guess 
what it will and what it won't work on. It is something 
like an oil company putting in a additive to gasoline 
which rots out engine gasket material without ever 
bothering to check it out with car manufacturers! Thus 
programs, error writers and copiers that work at these 
levels will in general be uncompatible with drives 
other than the 1541. You simply cannot expect equipment 
manufacturers to be able to forsee the various ways 
programmers might try to "defile the DOS". 

Making duplicates of this kind of software, if 
necessary, can be done like level three. The error 
maker will need to have the capability of writing data 
or errors beyond the normal tracks. The best approach 
for this level would be to remove the error checking 
from the loader or main program so that you won't have 
to worry about all the error checking problems every 
time you load the program. This is done virtually the 
same as the others, with relocate loads and 


81 



dissassombly. 


LEVEL 5.... This may be the most effective 
protection method in current use as well as the most 
valid. It works on the principle of a hardware "key" 
which is usually plugged in to the joystick port. As 
the program runs it can periodically check to see if 
the key is in and crash itself if it is not! The 
hardware key is effective for several reasons blit the 
most noteworthy is that most people have no means of 
duplicating the piece of hardware. Even if they could 
it would be a time consuming task to first figure out 
what the key contains and then make a similar one. 
Removing the sections of the program that check for the 
key would be the best approach but certainly not easy. 
As opposed to the error checking which reguires the 


disk to 

run and consume quite a 

bit of 

time. 

the 

hardware 

key can be validated 

in a 

matter 

of 


microseconds and has little or no degrading effect on 
the program. This is why error checking routines are 
often in a loader, so that they do not steal time from 
the main program. Many programs would be of little use 
if the protection system had to run the disk for a few 
seconds every so often in the middle of what you were 
trying to do. The hardware key does not suffer these 
limitations. It is possible to check for the valid key 
literally hundreds of times within the main body of the 
program, without noticeable time lag! If the checking 
is done during an interrupt cycle, the time, taken is 
almost unmeasurable. Appendix H shows how an interrupt 
routine can be easily accessed from a main program. 
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The key itself could be as simple as a plug with 
certain pins shorted to ground which the computer would 
see as a specific value anytime it looked at the 
joystick port. Using just the five joystick switches 
allows 31 possible code values that could be hardwired 
into a small plug. This will be defined as a passive 
key. You can easily make one of these for your own 
protected programs! This would not be too hard to 
defeat though if the user realized that it was just a 
hardwired setup. 

In more elaborate schemes, the protector can use a 
ROM chip which is addressed by a code sent on the lines 
and responds with a different value for each code. The 
circuit could send pulses of a certain frequency or in 
a certain pattern as the code. If desired the protector 
could use a complete microprocessor on a chip to 
respond .with a very complex set of passkeys. There is 
simply no imagineable limit to what could be done. 

Unfortunately we can offer no simple solution to 
the hardware key systems. If the key is the only 
protection, and the disk itself can be easily backed 
up, then you have little reason to worry. Your 
requirement for backup ability has been met while still 
protecting the seller from wanton distribution. We feel 
that it would be unethical for us to encourage 
reproduction of these keys. Thus in this respect, we 
feel key protection is valid as long as you can back up 
the magnetic medium. 
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One final word about compiled basic programs. The 
compiled program has been transformed into it's machine 
language equivalent, which among other thinqs, makes it 
harder to analyze. Using protection on compiled 
programs makes a very effective means of protection. 

In the future we hope to see prices of software 
come into line with value. New forms of protection are 
on the horizon but along with them comes the questions 
of compatibilty and effectivness against inspired 
pirating. 

- CARTRIDGE PROTECTION - 

Compared to disks, cartridges are quite simple. 
However due to the hardware necessary to make and use 
backups, the procedures are less well known. The real 
heart of cartridge protection is the autostart feature 
of the cartridge. Since it is running all the time, how 
do you disassemble or save it? The answer is just about 
as simple; do not let it autostart! 

Understanding an doing this depends on realizing 
that the only time the cartridge will autostart- is when 
the computer is first turned on or the coldstart or 
reset is initiated. If we disconnect certain lines on 
the cartridge and then turn on the computer the 
computer will not know the cartridge is there so the 
autostart will not occur. We can then switch the 
cartridge into certain areas of the computer and "look" 
at the contents or save them to tape or disk. An 
external RAM system which emulates ROM through the use 
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of a write protect can later be loaded with the 
original cartridge code, switched into the correct 
location, then run as though it were the cartridge 
itself! 


The most difficult obstacle to overcome with 
cartridges is the duplication of the hardware memory 
configuration used by the original. (See Chap. 3 
Hardware Reconfiguration) Although the C64 is "filled" 
up with memory, the cartridges can be "switched" in 
place of some other memory device. Even though this is 
not protection in the true sense, it has the same 
effect. The Romulator system (Chap. 7) gives you a 
procedure which does not require you to know 
specifically "where" the cartridge is seen at. All that 
is required is that you determine the configuration of 
the GAME and EXROM lines which ultimately control what 
the computer does with memory and start up routines. We 
have encountered no other forms of protection with 
cartridges. 


- TAPE PROTECTION - 

Tapes have severe limitations in the kinds of 
protection available compared to disks. As with the 
others, the autorun can and usually is used. The 
locations and method is really the same as the disk 
except that the autorun routine will boot in from the 
tape instead of the disk. 

In the next chapter we will cover the clone system 
which will duplicate all tapes regardless of protection 
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The LOAD data audio circuit provides an audio output during 
LOAD operations* This is useful in determining characteristics 
of pre-recorded program tapes* It also provides a simple way 
to align the tape head by "ear”. (Chapter five - Head aligoment 
procedure)* Installation can be in the computer or on lines 
D-4 and A-1 where they enter the datasette. If you are using 
a Tapeworm, or similar interface, parts can be mounted on the 
interface unit itself* (Use earphone for speaker) 

The SAVE data audio circuit is primarily for "Relocate Loading” 
which is detailed in chapter five* You may choose to wire two 
aligator clips to an earphone with a IK ohm series resistor* 

In this manner, you can simply clip it across E-5 and A-1 when 
you are performing header changes . The SAVE data audio 
circuit provides audio only during the time that the computer 
is saving data to tape* 
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used. As with disks, often a tape program will load in 
several sections which each set up certain parameters 
of the program and all are needed to run. If a save is 
attempted after loading the program only part would be 
saved and it would be useless. To duplicate this by 
other than cloneing requires that you know when each 
section starts and stops so that you can stop the tape 
and put in you blank to make a copy. Also, if you try 
this, be alert for machine sections mixed between basic 
sections. You will need to use an editor/assembler for 
the machine sections. 

Figure 4.1 shows the connections for an audio 
output which greatly helps in identifying separate load, 
sections. A taped program consists of a tone leader 
followed by a short data burst (header) then another 
tone leader followed by a longer data burst which is 
the program. If you hope to copy taped programs by 
saving, you will find the circuits very helpful. 

The one protection that tapes can use is the 
hardware key. However there is nothing to prevent you 
from making backup tapes, it will just keep you from 
distributing them or running on more than one computer. 
As with disks, this is not a real problem then for your 
own use. The one drawback is the reliance on the key 
itself, if it fries, you are out of business! 
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*** CHAPTER FIVE *** 


TAPES 


The very size of the C64 memory allows programmers 
to write some very powerful programs. As these programs 
reguire large amounts of data, they also tend to be 
guite slow if loaded from a datasette. As a result, 
tapes are not as popular as with the Vic 20. However, 
even if you .primarily use a disk drive, it is still 
handy to have a tape drive available. You may encounter 
a taped version of a program you wish to have. The cost 
of a datasette may prevent you from wanting to own one 
for this somewhat rare function. In answer to this we 
have developed a simple device which lets you avoid the 
expense of a datasette. Chapter five features TAPEWORM 
(tm) which is an inexpensive interface for standard 
recorders. If you do not own a datasette this circuit 
will allow you to add a tape drive for very little 
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expense. If you already own a datasette and wish to 
"clone" tapes using audio type duplication, the 
Tapeworm will provide you with the means to add another 
drive as required for dubbing purposes. Another of the 
major differences is that if you wish to do audio work 
such as message playback or time lapse recording etc. 
the inherent Tapeworm cassette motor interface will 
make this possible. Audio work cannot be done at all 
with the datasette since it utilizes digital signal 
processing. Tapeworm makes no change to an audio 
recorder circuits. It is entirely an external device 
which turns digital computer data into audio signals 
for the recorder and the opposite function of 
converting the audio output of the tape recorder to a 
digital level signal for the computer. The theory of 
operation will give more technical detail about these 
aspects for those so inclined. 

This chapter also features CLONEPLUG (tm) which is 
a simple plug that allows audio dubbing of digital 
tapes. In essence, Cloneplug is a dumb copier so 
virtually any tape can be duplicated. Although some 
have had success with doing this with two audio 
recorders, it is very unlikely that purely audio clones 
will work very well. The amount of signal degradation 
is severe if the data is not converted to, digital 
format. An audio clone is even worse in successive 
generations which have been cloned from a previous 
clone. The clone method we will show you relies on 
digital signals or audio-conditioned digital signals so 
that cloning can be done over several generations 
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without the inbreeding problems 


- TAPEWORM - 

DESCRIPTION 

TAPEWORM provides the proper interface circuitry 
between the Vic 20 and C64 computers and most standard 
cassette tape recorders. 


FEATURES 

The TAPEWORM is an inexpensive and reliable alternative 
to the purchase of single use cassette data recorders 
such as the datasette. 

When not being used with the computer, your cassette 
recorder can be used for normal recording applications. 
No changes or modifications need be made to your 
recorder. 

TAPEWORM allows the computer to control the cassette 
recorder to play and record voice/sound information 
under program command; i.e. f telephone answering... 
security monitoring... slide show sound... time lapse 
recording... etc. 

TAPEWORM allows manual adjustment of the volume output 
level of the cassette recorder so that you have the 
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TAPEWORM BLOCK DIAGRAM 

FIGURE 5.1 
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Computer output and input must be 5V square waves* When recording, 
the Tapeworm conditions the computer signal to feed the MIC input on 
the recorder. When playing, IClB circuitry restores the digital le¬ 
vel to the EAR signal from the cassette.___ 



ability to compensate for tape quality variations. 

With an optional modification, the data can be heard 
during the load operations to aid in analyzing 
protection methods. 

A.C. adapters are not needed. The cassette and TAPEWORM 
obtain all power from the computer just like a 
datasette does. 

Used with CLONEPLUG, TAPEWORM facilitates tape 
duplication using standard recorders and or one 
datasette and one standard recorder, (fig. 5.7) 

Simple to hook up. Ear, Mic, an power plugs provide all 
cassette interface connections without modifying 
recorder. 

Recommended tape recorders SANYO SLIM 1 or SLIM 2. 
Other tape recorders may work with TAPEWORM. Variations 
in record levels, fidelity, 6VDC connector polarity, 
voltages, etc. between manufacturers requires some 
technical discretion before making cassette recorder 
substitution. 


TAPEWORM THEORY OF OPERATION 

Refer to figure 5.1 for the block diagram showing 
function of Tapeworm. Note the cassette write and 
cassette read signals drawn at the left of the diagram 
by the computer block. As shown, both are five volt 
square waves. This is the normal digital signal the 
computer expects to "see". Cassette recorders on the 
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other hand, do not like five volt square waves. They 
are much better suited to smoother waveforms like the 
sinewave shown at lower right. Furthermore, a 
microphone input on a cassette recorder expects to see 
a lOmV to 20mV (0.020V) signal, NOT 5 volts! 

To accomplish this, the signal from the computer 
is fed through the input circuitry consisting of IC1A 
and the IK/100 ohm voltage divider. IC1A functions as 
an integrator which rounds off the 5V square waves from 
the computer. The voltage divider then reduces the 
voltage level seen at the Mic input of the cassette 
deck to about 20mV. The sketches of the signals in 
figure 5.1 show the approximate shaping taking place. 

For loading programs to the computer, the output 
of the tape recorder is a sinewave of about 6 volts. 
The output circuitry consisting of IC1B ■ and Q1 must 
provide a clean squarewave of 5 volts to the computer. 
IC1B is designed as a high gain clipping amplifier and 
Q1 provides a fast risetime 5 volt square wave of the 
correct polarity. This is fed into the cassette read 
line of the cassette port on the computer. 

As you can see from the schematic figure 5.2, the 
cassette switch line is always grounded. This causes 
the computer to always think the buttons of the 
cassette are depressed so that the computer will not 
print the "Press Play...." messages. This is done to 
eliminate the need for wiring inside the cassette deck 
to the switch which closes when the buttons are 
depressed. If you are technically able to determine the. 
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wiring on your particular deck and wish to do so, the 
circuit board has provision for this. Simply cut the 
ground link on line F6 and wire it to the switch in 
your deck. As this is awkward to do, we do not 
recommend it. 

The Tapeworm board obtains operating power from 
the computer via the 5VDC output on pin B2. Six volt DC 
power is fed directly from the computer pin C3 to your 
cassette deck. There is enough power at this output to 
easily drive most modern 6VDC recorders. You should be 
careful of polarity for your recorder, (see note below) 


ASSEMBLY 

Figures 5.2-5.4 give the schematics and layouts 
for Tapeworm. Appendix D lists kits available from 
PSIDAC or you may use your own resources. 

Before installing any parts, the circuit board 
should be cleaned with alcohol and scrubbing pad so 
that the copper is bright and shiny. All parts are 
installed from the BLANK side of the board with the 
leads protruding through the holes on the copper FOIL 
side of the board. Soldering should be done with radio 
grade rosin core solder and a small, clean soldering 
iron of 25 to 40 watts maximum. Be especially careful 
to orient the IC correctly. Use the pin 1 dot or 
notched end and the component layout for reference. 

The edge connector is soldered directly to the PC 
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board traces. You should first make a small solder 
"puddle" on each of the end foil traces which are for 
the edge connector. By holding the edge connector in 
alignment and then heating it's terminal with your 
iron, you can "tack" the lead in place. Do the same 
with the other end. This will hold the connector firmly 
in place. If necessary, you can remelt and reposition 
the connector until it is perfectly aligned. Then 
.solder the middle terminals down to the foil. Finally, 
go back and resolder the two end terminals to get a 
good shiny connection. 

Note that the Mic ground is not soldered at the PC 
board end. It is soldered at the Plug end. This 
prevents "ground loop" interference while still 
maintaining shield properties of the cable. An optional 
LED circuit is shown in the schematic. You can add this 
by drilling extra holes in the PC board. The LED will 
light up when data is being loaded to the computer. 
This helps you determine whether data is present as 
well as being an aid in deducing the number of separate 
data loads the program must go through to run. Some 
prefer this to the audio modifications shown in chapter 
4 and later in this chapter. 

POLARITY 


Be extra careful in wiring the audio plug. If you 
use any recorder other than the Sanyo recommended, you 
will need to determine the polarity. Most recorders 
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have a negative center pin. Sanyo is opposite! See 
figure 5.4 inset. If your recorder has the positive 
lead connected to the Mic and Ear ground pins (Positive 
ground system) you will not be able to use Tapeworm. 
(Some Panasonics are wired this way) 

If you make a mistake on the power connections, it 
will blow the computer fuse. It is highly .unlikely to 
cause any other damage. 


USE OF TAPEWORM 
HOOK-UP 

- Always plug the Tapeworm into the computer COMPONENT 
SIDE UP with the computer TURNED OFF! 

- Make sure all cassette recorder switches are up or 
OFF before switching the computer on. 

- Use high output, low noise tapes of good quality. 

- Insert MIC and EAR plugs into the cassette jacks 
marked MIC and EAR. 

- Insert Tapeworm plug marked DC6V into the cassette 
jack marked DC6V or 6V power. 


OPERATION 


- Turn on computer. 

- You can advance or rewind tapes at this time. 

- The cassette recorder volume should be set to about 
3/4 of full volume. This setting may vary depending on 
tape quality and recorder used. 

- The motor can be disabled by typing SAVE or S shift A 
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RETURN then hitting Run/Stop, 

- The computer SAVE, LOAD, and VERIFY operations will 
now function in accordance with the computer 
instruction guide. 

NOTE: The "PRESS PLAY ON TAPE" and "PRESS PLAY AND 
RECORD ON TAPE" messages will not be displayed when 
using the unmodified Tapeworm. 

- REWIND of tape is best accomplished by placing 
computer in READY state and using the VERIFY command. 
This will turn on the motor voltage and give you 
control of the tape deck. 

-Press RUN/STOP to disable manual control. 

- We recommend that you always advance tape past the 
leader when performing SAVE operations so that no data 
is lost trying to record on leader. 

OPTIONAL MODIFICATION 

When the Tapeworm EAR plug is in the jack on your 
recorder, the speaker is shut off by a switch built 
into the jack. By jumping this switch with a resistor, 
a comfortable audio output will be obtained. This is a 
feature you may like. It allows you to hear when data 
is present on the tape. Figure 5.5 shows how to do this 
on a Sanyo Slim 1 or 2. For other recorders, use the 
information in figure 4.1. 
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USE 


A SMALL PIECE OF TAPE UNDER 
RESISTOR FOR INSULATION 


FIGURE 5.5 



SANYO SLIM I & II 
(USE FIG.4.1 FOR OTHER RECORDERS) 


HEAD ALIGNMENT 


Normally all tapes recorded on your recorder will 
be in alignment with the tape head and each other. 
However, tapes made on different recorders or some 
commercial tapes may not be aligned with your machine, 
resulting in difficult loading. If you are using an 
older tape recorder, you may need to align it with a 
commercially made tape before using it extensively. 
This will assure accurate loads of commercial tapes AND 
your own tapes. It is not a good idea to change the 
alignment once it is adjusted for normal tracking.. 
Otherwise you will end up with a mess of misaligned 
tapes, each requiring realignment to load properly. BE 
SURE IT IS NECESSARY BEFORE PROCEEDING WITH HEAD 
ALIGNMENT! 
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If you are using a datasette you will need to wire 
the "LOAD DATA AUDIO" circuit (fig. 4.1), or use an 
oscilloscope. If you have this circuit already or it's 
equivalent, simply ignore the reference to "Ear Plug" 
in the following procedure. 

- Unplug "Ear" plug. 

- Put in tape do not close cover. 

- Locate alignment hole left of tape head, (see sketch) 

- Set volume 1/4 to 1/2 of full - Press Play. 

- Adjust screw for loudest output. **Do not turn far! A 
slight adjustment back and forth only!** 



ADDITIONAL INFORMATION 
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Other brands of recorders usually work well with 
Tapeworm. However/ if recorder voltage is different 
than 6VDC, you cannot use the power plug.supplied. 
Instead, you can use the adapter or power source 
normally supplied with your recorder. This will require 
that you control your recorder MANUALLY since Tapworm 
normally controls the recorder through the 6VDC power 
plug. 

Another inherent feature of using a standard 
recorder with Tapeworm is that it is still a normal 
recorder and as such can be used for audio work under 
control of your computer. By unplugging the Mic and Ear 
plugs and using only the 6VDC power plug, the computer 
can start and stop the recorder under program command. 
The most efficient way to do this is to use a line 
similar to this for turning motor ON: 

1OOPOKEl,PEEK(1)AND2 23 
For turning motor OFF: 

110POKE1,PEEK(1)OR32 


CLONING 


Fighting tape protection schemes can be a 
frustrating experience. In the least, it can become 
more time consuming than desireable especially if you 
just need to make a backup so that you can file the 
original for safekeeping. For these reasons we suggest 
that under all normal circumstances that you simply 
"Clone" the original using the cloneplug system we 
describe. As a dumb copier, the cloning method does not 
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FIGURE 5.6a 
CLONE CIRCUITRY 


CASSCTTC FORT 


CLONC PLUG 



FIGURE 5.6b 


SPOT SWITCH 



7 CLONE MOD. ON TAPEWORM 



Figure 5«6a is the schematic of a clone plug# Note that if 
You are using one or more datasettes, that you will need the 
90° plug* See figure £.8 for PC layout. 

Figure *6b shows how to modify a Tapeworm so that you will 
not need a clone plug. (You must use two standard recorders 
which work in the normal manner with Tapeworm bo use this 
modification) You can either modify the artwork of figure 
5*3 or remove traces from two lower pads and use jumpers for 
changes indicated in solid black* Clone is C-D, normal C-N. 
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depend on or vary with the type of protection used. 

Although we have heard of some people obtaining 
useable copies with a straight audio to audio method 
and two tape recorders, we do not feel that it is a 
very good method. The reason lies in the fact that the 
signals used by the computer are not exactly the same 
as audio signals. The frequency requirements and 
tolerance to wow and flutter is not as great with these 
digital signals. As a result, the audio to audio method 
induces problems which are minor in audio recordings 
but seriously degrade digital data. If attempted at 
all, the audio method should use high quality reel to 
reel recorders and the copies should always be made 
from an original. 

The Cloneplug system is a simple arrangement which 
uses the Tapeworm and/or datasette itself to restore 
the digital characteristics of the signals before 
sending them on to the recorder making the copy. This 
will normally allow good clones up to four or five 
"generations" removed from the original. However, when 
possible, best results are still obtained when the 
original is used for cloning. 

One major feature of the Cloneplug system is that 
you can use two standard recorders and one Tapeworm, or 
two datasettes and no Tapeworm, or a combination of a 
standard with Tapeworm and a datasette! Figure 5.7 
shows the different hookups to match the equipment you 
have available. This way you should be able to use 
cloning with a minimum hardware aquisition. 
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FIGURE 5.7 
CLONE HOOK-UPs 
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CLONING PROCEDURE 


Before cloning, be sure that the recorders that 
you are using are compatible with the Tapeworm and C64. 
If you are using datasettes only and no standard 
recorders, you will not need to worry about Tapeworm. 

1. Determine the correct hookup from figure 5.7 based on 
the type of recorders you are using. 

2. Place original tape in PLAYBACK DECK. NOTE: PLAYBACK 
DECK plugs into main (horizontal) edge of Cloneplug. 

3. Place blank tape in RECORD DECK. NOTE: RECORD DECK, if 
using 5.7b or 5.7c, plugs into vertical (90 degree) 
plug of Cloneplug. 

4. Make sure proper cassette buttons are set. Enter LOAD 
command on computer. 

5. When done , verify clone by loading it. 

6. Best results are obtained if you record the clone on 
the same deck as you normally use to load programs when 
not cloning. 


SAVING TAPES 


There are times when you may wish to Save a 
program via the computer instead of cloning. The 
biggest advantage to doing this is that the "Saved" 
program is equal in quality to an original tape. 
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Secondly, you do not have to use two recorders and play 
around with external hardware. The main disadvantage is 
that you need to have a good handle on the protection 
being used. Often this will mean simply to know how 
MANY sections a program loads in, where the sections 
load TO, and whether the program sections are MACHINE 
or BASIC. Following is a general outline of procedures 
to make direct computer saved copies of many taped 
programs. 

Start by determining the number of separate loads 
taking place. This can be done by listening for the 
long tone leader followed by the short header burst. 

Another way is to watch the screen for the FOUND . 

interval which occurs after the header. 

STOP the computer after each header load (before 
data load) and use an editor/assembler to read the tape 
buffer. Write down the starting and ending address 
given on each header. NOTE: DO NOT LOAD THE PROGRAM 
SECTIONS. Fast forward past these to the next header. 

When done you should have a list that looks 
something like this: 

lrst PRG. Starts $02A7 Ends $030B 
2nd PRG. Starts $0801 Ends $30FF 
3rd PRG. Starts $C000 Ends $C400 

Remember that your list values will be in hex. 
Programs that load below $0801 probably have something 
to do with autorun and will require relocate/loading 
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(sec separate? section this chapter) to load and save. 
Write R/L by each of those on your list. The programs 
above $0801 can bo saved separately as machine or 
basic. If they are at $0801 you can load them 
separately and list them to see if they make sense as 
basic routines. If so, write BASIC beside them and when 
you save them for your final duplicate, they will be 
saved via the basic "SAVE" command. Assume the rest are 
machine language, they will be saved with the 
editor/assembler. Write Mach. beside each of these on 
your list. 

To make the backup, you will need to save each 
program in order on your copy tape. Using your list, 
perform a LOAD"",1,1 and the appropriate save for each 
program. (Use TRELO and its special save procedure on 
those indicated R/L) If all goes well, your final tape 
will have an exact copy of the original programs. If 
you are so inclined, you may try to defeat the autorun 
feature all together so that your copy will be easier 
to duplicate for future backups. 

MACHINE SAVES 


If you are not familiar with editor assemblers, it 
may seem like a big chore to do machine saves. This is 
not true, it is a very simple process which you need to 
know. We recommend the use of Monitor$8000 and 
Monitor$C000 which Commodore sells on it's "Commodore 
64 Macro Assembler Development System", (see chapter 2) 
When modified according to appendix B, any area in 
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memory can be saved with the "S" (save) command as 
follows: 

S"prg name",01,beginning hex address, ending hex 
address 

NOTEsthe 01 indicates tape drive. For disk use 08. 

As you can see, this is a natural with the 
information provided by the tape buffer. 

RELOCATE LOADER for TAPE 
TRELO-TMACHRELO 


The main purpose of the Relocate load (r/1) 
process is to force programs to load in the wrong place 
so that autorun and other "disabling" features will not 
operate.- This allows you to "get into" the program and 
find out what it does. In some cases, we just want to 
be able to Save the program, which of course can't be 
done if it is running. The basis of the technique given 
here is that autorun routines which keep you from 
getting into programs are normally loaded into memory 
locations in the "control zone" before $0801. 

The tape relocate/loader will shift the program 
up in memory to $2000. Thus a autorun which normally 
loads to $0100 will be loaded by the R/L to $2000. 
This relocating process will keep the program .from 
running. The save is performed by TRELO as a machine 
save from $2000 to the "new end" of the program. TRELO 
does all the calculations for you and displays the 
original addresses so you can replace them in the tape 
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header. 


Since the relocated program SAVEs from an 
abnormal location, it will not yet load and run 
correctly. The trick is to EDIT the header data that 
tells the program where it will load to. In other 
words, your copy must have a different header put on so 
that it will load to the normal location instead of the 
relocated area. This procedure is called "header 
swapping" and. can be tricky. It will require the use of 
the "Save Data" audio circuit of figure 4.1 or split 
second timing. If you use the timing method you only 
have about +/- 0.5 seconds to react. Also close 

attention needs to be paid to the EXACT start of the 
header on the tape. The process involves replacing the 
relocated copy's header with a "normal" one. The 
following step by step procedure will simplify this 
process for you. 

RELOCATE/LOADER PROCEDURE 

1. Load and run TRELO. 

2. Follow prompts to make relocated copy. Before making 
the new header, study the following steps. They direct 
you through the process of putting a NEW header over 
the one with the relocated address. (TRELO keeps track 
of the correct addresses for you) 

3. Connect "Save data audio" .circuit or obtain accurate 
STOPWATCH. The audio method is more reliable. (With 
some monitors, you can turn up the volume and it will 
pick up the SAVE audio, eliminating the need for the 
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circuit or stopwatch. Check this by SAVING a program 
with your monitor volume at full) . 

4.Set up relocated copy tape at the very beginning of 
FIRST tone leader. This positioning is critical if 
using timing. 

5. Follow prompts. By listening to data, allow to save 
ONLY THE HEADER, then STOP tape recorder. (Or time for 
13.1 seconds) 

6. If all went well, your relocated program will have a 
"normal" header which will cause it to load and run as 
it should! 

HINT: Practice listening to tape saves and loads to get 

used to the "sound" of headers and data loads. (see 

sketch) With a little practice, you will be able to 
accurately respond to the short break between. You 
must use the same name on the relocated copy and the 
doctored header so that the time for the header will 

not change. Be careful to start the tape in the same 

place when editing as when the relocate load was done. 
This will prevent it from recording over the data. 

TAPE HEADER CONFIGURATION SKETCH 


ALLOWABLE OVERLAP (HDR SWAP) 



TAPE TO DISK TRELO PROCEDURE 
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1. Load TRELO and RUN. 

2. Follow prompts for disk. WRITE DOWN ORIGINAL STARTING 
ADDRESS! Convert to HEX, break into HIGH byte and LOW 
byte. ie: if calculated value is $02A7 High byte =02 
Low byte =A7. 

3. When process is finished, use SUPERDIRECTORY to find 
the starting TRACK and SECTOR used by the disk to store 
your program. 

4. Use DISK-EDITOR to change the starting ADDRESS on the 

Relocated copy back to what you calculated. (Original 
Address) The third location from the top left on Disk- 
Editor display is the LOW byte. Replace the THIRD BYTE 
TO YOUR CALCULATED LOW BYTE. The Fourth location is the 
HIGH byte. Change the FOURTH LOCATION TO YOUR 
CALCULATED HIGH BYTE. Hit RETURN and follow prompts to 
save data. (Chapter six has more info on DISK- 

EDITOR) 

5. Relocated copy should now run normally. NOTE: NOT ALL 
PROGRAMS CAN BE SUCCESSFULLY COPIED WITH THIS 
PROCEDURE. 

NOTE: if exchanging program medium from tape to disk, or 
vice versa, remember to change the device number in 
the booter section. 
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TRELO 


1 IFR=0THEHR=1•LORD"TMRCHRELO",8,1 

2 POKE53280,11=P0KE53281,11 

3 PRIHT'TIrCT TRELO/LORDER IPSIDRC <084 VBH sT : PR I NT " MW" ; GOTO 15 

8 PRINT "?PUT CPV TAPE IN DRIVE - SET FOR Si RECORDS" ; PR IN f" flPRESS F7" 

9 GETA* : IFR*0"II"THEN9 

10 PRINT" WEAVING ";HF$; " FROM ";BG;" TO " ;Efl: SV38043 

11 I FCK*= " D " THENOPEN 15,8,15:1 NPUT # 15, AS, B$, C$, D* • F RI NT " W" fit , BS, CS, B S: CLOSE 15 

12 POKE3047,1 POKE8049,l:INPUT"lPat1RKE HEW TAPE HERDER";AK$ 

13 IFRK$="V"THEN100 

14 IFCK$="D"THEN200 : END 

15 PRINT"WF‘LRCE ORIGINAL TAPE IN DRIVE" POKE 1,PEEK<1)RND223 

20 PR I NT" MPERF ORM TAPE LORD... WHEN FOUND MESSAGE" 

21 PR I NT " MRPPERRS, SRUN/STOPal THEN ENTER HRUN25tf'-EHD 

25 P0KE52,20:P0KE56,20=POKE53280,11:P0KE53281,11 

26 AH=PEEK<830> = RL=F'EEK<329):BH=PEEK<832> =BL=PEEK<831> 

27 UD= <PEEK< 836>*256 >+PEEK <829>:0E=< PEEK <832 > *256)+PEEK<831 •:BV=OE~OD 
23 BG=32*256:P0KE254,32 : P0KE253,0 

30 PRINT'TWII TRELO/LOADER IPSIDRC <084 VBNsT 

32 POKE 1, PEEK<1>AND223:PRINT"WSREWIND TAPE 9PRESS F7 WHEN DONE" 

33 GET A * I FASO " II" THEN33 

34 POKE1,PEEK (1)0R32 : PRINT"HSPRESS PLAV S 

35 INPUT" ifllNPUT -EXACTS FILENAME"; NFS:NL=LEN<HF$>:P0KE251,NL 
40 3VS3083 : SVS3103 

45 pRiNT"nrrm of bvtes="bv;" " ; ea=bg+bv 

50 PRINT".ORIGINAL STARTING ADDRESS = " ;0D : PR I NT "ORIGINAL ENDING ADDRESS = ";0E 
55 INPUT"MSAVE ON T/D";CK.$: IFCK$=»"T"THEN8 

60 PRIHT"nPREP DISK TO COPV - F7 WHEN READV"‘POKE8047,8 : POKE8049,8 : G0T09 
100 P0KE838, AH: P0KE829, AL: P0KE832, BH: P0KE831, BL: P0KE254, AH: P0KE253, AL 
105 POKE175,BH : POKE174,BL 

115 PRINT'TM * ROUTINE TO REPLACE TAPE HEADER *" 

120 POKEl,FEEKX1>AND223:PRINT"W SREWIND TAPE TO EXACT BEGINNINGS" 

125 PRINT"GF7 WHEN READV!" 

130 GETAi : IFA^O"ll"THEN 130’ 

140 PR I NT " TTlEFRESS PLAV AND RECORDS ": POKEl, PEEK <1)0R32 

150 PRINT":«mriME FOR sEXACTLVJil 13.1 SECONDS*." :PRINT"fflTHEN HIT SRUN/STOFS" 

160 PRINT"WF7 WHEN READV" 

170 GETA$: I FASO" II" THEN 179 
ISO SVS8043 

200 PRINT"MUSE DISK-EDITOR TO RESETS! LOAD TGk ADDRESS" 


I 
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1F61 

R4 

FE 


LBV 

$FE 

1F63 

20 

B5 

FF 

JSR 

$FFB5 

1F66 

20 

R0 

IF 

JSR 

$1FR0 

1F69 

60 



RTS 


1F6R 

00 



BRK 


1F6B 

20 

95 

IF 

JSR 

$ 1F95 

1F6E 

R9 

01 


LBR 

#$01 

1F70 

R2 

01 


LBX 

#$01 

1F72 

R0 

FF 


LBV 

#$FF 

1F74 

20 

BR 

FF 

JSR 

$FFBR 

1F77 

R5 

FB 


LBR 

$FB 

1F79 

R2 

B1 


LBX 

#$B1 

1F7B 

R0 

02 


LBV 

#$82 

1F7D 

20 

BB 

FF 

JSR 

$FFBB 

1F80 

R5 

FB 


LBR 

$FB 

1F82 

85 

FC 


STR 

$FC 

1F84 

R5 

FE 


LBR 

$FE 

1F86 

85 

FB 


STR 

$FB 

1F88 

R9 

FC 


LBR 

#$FC 

1F8R 

R6 

RE 


LBX 

$RE 

1F8C 

R4 

RF 


LBV 

$RF 

1F8E 

20 

B8 

FF 

JSR 

$FFB8 

1F91 

20 

R0 

IF 

JSR 

$1FR0 

1F94 

60 



RTS 


1F95 

R5 

01 


LBR 

$01 

1F97 

8D 

R7 

02 

STR 

$02R7 

1F9R 

29 

FE 


AND 

#$FE 

1F9C 

85 

01 


STR 

$01 

1F9E 

60 



RTS 


1F9F 

00 



BRK 


1FR0 

RD 

R7 

02 

LBR 

$02R7 

1FR3 

85 

01 


STR 

$01 

1FR5 

60 



RTS 


1FR6 

00 



BRK 


1FR7 

R6 

FB 


LBX 

$FB 

1FR9 

BB 

40 

03 

LBR 

$0340 * X 

1FRC 

9B 

B0 

02 

STR 

$02B0 * X 

IFfiF 

CR 



BEX 


1FB0 

B0 

F7 


SHE 

$1FA9 

1FB2 

60 



RTS 
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*** CHAPTER SIX *** 


DISKS 


If the point has not been, made clear enough yet, 
let me restate it here, at the beginning of the chapter 
you may have turned to first. There is not now, and may 
never be, a single software solution to the protection 
used on disks. Regardless of the optimism of 
advertisements in general, neither we nor anyone else 
can offer a 100% solution or method for protection 
breaking. The more you understand the disk drive and 
it*s potential, the clearer this point becomes. What 
happens is that as a consumer you get caught in an 
endless vicious cycle of new protections and new 
products to break them. Everyone makes money at your 
expense! The true solutions lie in your ability to 
become a "detective” of sorts and to have tools that 
are adaptable to the situation. With this in mind, we 
make little attempt to supply overglossed, (and 
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pricod), declining term software. Instead we have 
developed some raw utilities which allow you to obtain 
information, look into and modify programs, override 
disk operating systems, and in general, to give you 
control of what should be done. 

This chapter consists of three main sections. The 
first will cover each of the disk utilities in terms of 
what it is, generally what it does, and special 
operating details. Chapter two gives a shorter, less 
specific introduction to the various utilities for 
disk, tape, and cartridge. The second part of this 
chapter will give you some specific procedures to 
follow in attacking different types of problems. It 
will cover some of the common ways you would combine 
several utilities in a logical sequence to breaking a 
program. The third section gives you the actual 
listings of the programs and any pertinent loading 
details. 

SECTION 1 - UTILITIES 


SUPERDIRECTORY 

C.ives you an expanded directory of whats listed in 
the normal disk directory. The additional features 
include identification of the starting track and sector 
for each program and file, listing of deleted programs 
and files, and the starting address of each program 
given in hex and decimal. Although this may seem 
innocuous at first glance, it is really a key to 
determining what you may be up against on a given 
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program. If for example, the program shows a starting 
address of less than $0801, it will affect the control 
zone and may be an autostart. Relocating will probably 
be needed if you wish to save or pick. The number of 
blocks used by the program will give you an idea of 
what its function may be. Again, a short routine loaded 
first is likely autorun or autoboot. If the program 
begins at 0801, it is probably basic and if loaded by 
itself, you will probably be able to list it. There is 
however, no reason that it cannot be machine language, 
so be ready to try disassembly also. Do not run a 
routine first, often the program can be listed before 
you run it but you may lose control after you run it. 
In addition, if the program is loaded separately, it 
may not run correctly as the other sections are often 
needed. 

Programs starting in the $033C-$03FF range are 
usually machine routines or access keys which reside in 
the tape buffer. In these you should look for a 
meaningful dissassembly or ASCII code representing 
information. 

Programs above $0801 will often be machine 
language routines or hex data used by the main program. 
Blocks in the $8000 and $C000 range are popular for 
machine programs and data. 

Superdirectory utilizes the machine routine 
"ADMACH" in its operation. Loading and running 
Superdirectory will automatically load ADMACH. Use of 
Superdirectory is simple, after loading and running, it 
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will give you the option of sending the output to the 
printer as well as the screen, then asking for the disk 
to be examined. We recommend that you print a 
Superdirectory for every disk you have, and make it one 
of the first things you do with new disks. 

RELOCATE/LOADER 

One of the disadvantages of using whole disk 
copiers is that an entire disk may be required when 
only a small portion of that disk is actually used. 
Many people like to combine similar programs on a disk 
so that they might have several games on one disk, 
several utilities on another, business packages on 
another, and so on. In order to "pack" a disk with 
different programs you usually need to use normal basic 
or machine SAVE commands. As you well know, commercial 
prgrams do not usually lend themselves to this 
operation. 

The premise of Relocate/loader is that if a 
program is loaded to the WRONG PLACE, it will not take 
control of the system. Thus you are free to SAVE at 
will. The R/L has the SAVE routine as an inherent part 
of its operation. The most important thing to remember 
is that the relocated copy will always have a starting 
address of $0A00, regardless of where the original was 
supposed to reside. Thus the relocated copy cannot RUN 
until its starting address has been doctored. That is 
one of the primary purposes of Disk-Editor. 
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If you wish to pick the program, you can use the 
relocated version before you change the address back. 

The disk version of Relocate/Loader uses a short 
basic program to . control the machine relocating 
programs. The machine routines are loaded through the 
basic main program. "MACHRELO" is the name of these 
machine routines. One Of the things done by the system 
is that basic is switched out during the relocating 
process. This along with the compact size of the basic 
main and machine routines allows us to sgueeze in a 50K 
byte buffer. The size of this buffer should allow the 
use of R/L on the vast majority of "long" programs. 
DISK-EDITOR 

As one of the primary uses of Disk-Editor is to 
allow you to change the addresses contained on a disk, 
we will go into this next. Each sector of the disk 
contains header information and then a "block" of data 
which is 256 bytes in size (binary, actual GCR format 
is longer by 4:5 ratio, see Appendix F). Disk-Editor 
allows you to dump any block on the disk to examine it 
or to change any of the data contained in the block. On 
every block, the first two bytes of data tell which 
block is next on the disk. In this manner, the drive 
can "link" all of the blocks together which belong to 
any given program. Disk-Editor shows the links in 

green. On the first block of a program, the second and 
third bytes give the starting address (hex) of the 
program. These are the two bytes you need to change 
when "resetting" the address, on a relocated program. 
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Once these addresses have been reset to their original 
values, the relocated program can be loaded an run as 
though it were the original! Remember that the two 
bytes you change are in hex and in the standard 6502 
format of low byte first, high byte second. Also 
remember that they are contained on the starting sector 
of the program. These locations in the rest of the 
sectors contain program data. 

There may be times when you will want to change 
some of the data within a particular sector of a disk. 
Disk-Editor gives you this option. It is simple to use, 
you postition the cursor over the bytes you wish to 
change, and type in the new values. When you have 
completed all the changes for a given sector, hitting 
the RETURN key cause the changes to be read and prompt 
you on whether you desire to actually write the changes 
onto the disk. 

Disk-Editor is a basic program which loads its 
machine subroutines under the name ADMACH. As with the 
others, you must run the basic program to load the 
machine routines. If you get into a situation where you 
need to re-RUN the main program, you can always skip 
the first line which calls the machine load, as long as 
the machine program has not been wiped out in some 
manner. This is true of all of our basic/machine 
programs. 

LINKSTER 

Linkster is a basic program which gives you a 
complete list of sector links for a given program. 
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Linkster allows you to specify which track and sector 
you would like to begin with/ then it will print a list 
of all the tracks and sectors used from that point in 
the program. You do not have to start linking from the 
beginning, it will just give you the ones from the 
point you choose. Linkster also counts the number of 
blocks from the point you started. The printout can be 
screen only or screen and printer. 

Other than simply finding out where a program is 
stored on your disk, linkster can be used to find bad 
sectors when a program disk becomes defective and 
looses some data. If you have a program which loads for 
a bit and then stops and returns a disk error, use 
linkster to find out which sector the error is coming 
from. You can then concentrate on "fixing" the sector. 
If it is really bad you may be able to change the 
previous link so that the program "skips" the bad 
sector. In some cases you can list the program and 
replace what is missing by hand and then resave the 
"repaired" program! 

ERROR ANALYZER 

Error Analyzer checks an entire disk for errors by 
either a sector by sector check or by a track by track 
check. Error Analyzer checks tracks all the way to 44. 
This gives you the ability to find out if any level 4 
protection has been used on the disk. The track by 
track check is primarily a sync locator which can 
indicate if sync has been wiped out on any normal 
tracks and if any has been written on the "extra" inner 
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tracks above 3 f >. Many of the protection methods such as 
wiping out a track, erasing sync, or writing to the 
extra tracks can be detected by this program. If any 
information or protection codes have been written to 
the "extra" tracks, this is the only program that will 
detect that, and do so in a short amount of time. 

The track by track check only takes about 45 
seconds and is a good idea as a primary test on new 
programs. The sector by sector test takes longer but is 
more thorough. When errors are found the program is 
designed so as to not "bump" the disk head which can be 
detrimental to alignment on some disk drives. Instead 
it uses a machine programming technigue which will 
recheck each track or sector four times and then go on 
to the next. You will appreciate this feature on disks 
with lots of errors. It is quicker, cleaner, safer, and 
doesn't make your disk sound like its having a cow. 

Error Analyzer lias printer options on both checks. 
This will give you a convenient paper listing of the 
errors found. These printouts supplied by our programs 
should be used as a "map" as you work back through your 
copied program to get it operating. With current 
protection involving many errors in various locations, 
you will need these printouts to work your way through 
the "patching" chores on your copy disk. 

T/S ANALYZER 

T/S Analyzer has the primary purpose of producing 
a error log which can be stored as a file and passed 
along to Fastback. Although T/S does not have the 
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advanced reading technique of Error analyzer, it does 
have several logging options and serves as a map maker 
for Fastback. If you plan to be doing a lot of copying, 
you should format a disk especially to hold your T/S 
error logs. In this manner, the log only need be done 
once when the disk to be copied is new. As time goes 
on, you will build a file of error logs and if you ever 
need to do another backup you can simply load Fastback 
and through it, the appropriate error log for the 
program in question. The output of T/S tells both what 
errors are encountered as well as which sectors contain 
data and which sectors are unused on the disk. This can 
be helpful to locate sectors which have data but are 
not called through the normal linking method. If a 
sector has been destroyed, linkster cannot find out 
what is beyond the bad sector. T/S can give you a clue 
as where to pick up from! 

T/S loads its machine routines under the name 
"ANALYMACH". As before, this is done in the first line 
of the program. T/S gives you four options. First to 
analyze the Tracks and Sectors on the disk being 
tested. Once this is done you have the choice of (2) 
printing the log or (3) saving it to your log disk. The 
final option is to load an error log previously saved. 
You can then print that if you desire. This allows you 
to make your logs at one time and then later as the 
need arise.s or it becomes appropriate, you can make a 
printout. The number of errors counted is kept track of 
and printed out for your convenience. 

FASTBACK 
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The error loq from T/S, which Fastback asks for, 
relieves Fastback from having to bother with any empty 
or bad sectors on the disk. Only those with valid data 
are loaded into the buffer and subsequently saved on 
your copy disk. Thus Fastback is just about as fast as 
a copier can be. The operation is comparable to a DAM 
copier which only copies those sectors containing 
program. The difference is that it is not using an 
easily destroyed BAM but rather a verified list of 
which sectors have data and are copiable. 

Once a Fastback copy has been made, you can use 
the error log printouts which indicate where changes, 
or errors need to be. Error writers or Diskpicker can 
be used to put errors on. Alternately you may choose to 
list/disassemble the program and try to modify the 
sections which look for the errors. There may be data 
in the sectors with errors that you will need to 
recover. Fastback loads its machine counterpart 
"ANALYMACH" in the first line of the program. 

DD-1 


DD-1 is the name of a group of four programs which 
provide direct duplication via whole disk copy. The 
programs are 1DUPDAC and its controller 1PSIMAIN which 
are for single disk copies. 2DUPDAC and its basic 
controller 2PSIMAIN are used for whole disk copies with 
two disk drives. Although not as advanced in technique 
as Fastback, you will find DD-1 is very handy to make 
an on the spot backup of a less protected disk. It can 
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be quite fast if the original is only partially full 
and you make use of the fast copy features. 

The programs are able to copy many of the lower 
level protection disks since they provide a direct 
track by track duplication which does not depend on 
BAMs, and it skips over errors. A 150 block buffer is 
used for a minimum number of swaps. Track and sector 
manipulations are handled by machine routines for 
maximum reading and writing speed. Error decoding 
allows simple operation and circumvents many error 
protection schemes. 

The system also features an error display which 
can be sent to a printer for logging and later error 
writing or removal. DD-1 will skip sectors which 
contain errors designed to stop whole disk copiers. If 
the program requires the errors to be present you can 
use diskpicker or an error writer to replace them. 

The. "fast write" feature of DD-1 causes the 
program to skip over the writing of any sectors which 
contain only format data and no program data. For 
compatibility with other drives, this can be set to 
look for a normal Format of "ONEs” or "ZEROs". The 
program checks the contents of the sector before 
writing it and if it contains only format data it will 
skip to the next. 

The Multiple Copy Option allows making more than 
one copy per original - without rereading the original. 
This will allow you to read in a section of the 
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original, then write it to several copies, and so on. 
*This saves a great amount of time since the original is 
only read once. 

After chosing either 1 or 2 disk drives, the 
corresponding OtJPDAC is loaded. Then type NEW and load 
the basic PSIMAIN version that corresponds to the 
number of drives you are using. The options and 
procedure for DP-1 are given in the procedure part of 
this chapter (section 2). 

DISKPICKER 

Diskpicker is a machine language development 
system for the 1541 disk drive. It is designed to allow 
you to develop machine language routines in the C64 
memory space and then transfer them to the disk drive. 
From there, the routines can be executed from a control 
menu in Diskpicker. The memory transfer features of 
diskpicker allow you to transfer any or all of the disk 
drive memory contents into the C64 memory space. It can 
then be examined, printed, modified an so on. Since 
Diskpicker uses the Commodore MONITOR$8000, you have a 
full featured editor assembler for accomplishing the 
various machine language tasks. Diskpicker also 
utilizes ZMACH which gives it the ability to switch 
effortlessly between its basic and machine functions. 

You may wish to make a ROM listing of your disk 
drive ROM using diskpicker. The 16K size will make a 
ra'ther large printout however. The disk controller 
routines that you will need the most reside from F24D 
to FFFF and thus makes a much shorter listing. 





In addition to writing routines to bo sent to the 
disk drive, you will also be able to load sectors from 
the disk drive and transfer them back to computer 
memory to see what is there. Diskpicker allows you to 
look at header images , and other format information 
that you normally couldn't see. Also modified headers 
can be created which will produce errors if read 
normally. With diskpicker, special machine language 
routines can be written to find and read data after 
these modified headers. This gives you the power to 
experiment with protection methods of your own as well 
as read out data that would otherwise be hidden. 

The specific procedure for Diskpicker will be 
given in the next section but the menu options 
available are as follows: 

1.. .Transfer disk memory to buffer (in C64) 

2.. .Enable monitor (machine E/A) 

3.. .Transfer (C64) buffer to disk memory space. 

4.. .Direct execute user program. 

5.. .Job Que execute user program. 

6.. .Load Sector to disk buffer. 

7.. .1.itialize disk I/O. 

8.. .Format Diskette. 

ZMACH 


Zmach is a short machine routine which you can 
load any time you are using an editor assembler, 
particularly Monitor$8000. Zmach provides you with a 
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way to save? and restore zero page as you go back and 
forth between basic and machine language. This is 
necessary to prevent, "lock up" of the computer when 
exiting from the editor assembler. When loaded, before 
going to the E/A, you SAVE ZERO PAGE by typing SYS49152 
RETURN. Later, after you exit from the machine monitor, 
you type SYS491B4 to RESTORE ZERO PAGE. 

SECTION 2 — PROCEDURES 


We will start this section with general procedure 
to follow with any new disk and then we will cover 
remaining individual utility programs with special 
notes to make you aware of additional options that may 
not be obvious from a users standpoint. 

1.. .Do a SUPERDIRECTORY listing of what is on your new 
disk. If you have a printer, make a hard copy for your 
records. 

2.. .Run an ERROR ANALYZER TRACK check. This will identify 
use of error protection and extra tracks. Make hardcopy 
if errors show up. Next do a TRACK and SECTOR analysis, 
making hardcopy as needed. 

3.. .Choose copy method. DD-1, FASTBACK or RELOCATE/LOAD. 
Go directly to procedure for method chosen. 

DD-1 PROCEDURE 
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1.. .5ELECT and LOAD "1DUPDAC",8,1 then NEW and LOAD 

"1PSIMAIN",8 for single drive users. 

2.. .5ELECT and LOAD "2DUPDAC",8,1 then NEW and LOAD 

"2PSIMAIN",8 for dual drives. 

3.. .PRINTER option. List and change line 1 P=0 to P=1 to 
turn on printer. F7 must be pressed after each error 
printout unless last line of program is changed from 

. SYS49903 to SYS49881. NOTE: if you use this option a 

lot you may wish to save the modified version for your 
own use. We have chosen this method of configuratioA 
over a menu to conserve memory for buffer space. 

4.. .5ET FAST COPY MODE. Run selected DD-1 program with 

disk to be copied but STOP after the first few sectors 
have been read on track one. ?PEEK(2561) and 
7PEEK(2502)• If both are 1 then POKE49747,l and 

P0KE49751,1. If both PEEKs were 0, then do nothing. 0 
is default value for DD-1 FAST COPY. 

5.. .5ET MULTIPLE COPY option. Default makes one copy. 
P0KE49174, [number of EXTRA copies desired]. Note that 
the value you poke will produce that many EXTRA write 
cycles. Thus poke 1 for 2 copies, 2 for 3 copies and so 
on. The default value of 0 produces one copy. 

6.. .DUAL DISKS? device number 8 for original disk, and 
device number 9 for copy disk. 
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7.. .Run J)D-1 program chosen. You must use previously 
formatted disks for copies since DD-1 has no format 
option. If you forget, just RUN/STOP and format disks 
in normal way. (Do not use wedge), then RUN again. 
Follow PROMPTS on screen. 

8.. .Bell indicates program read or write is active. TRack, 
SECtor, and ERRor displays indicate current location 
and any errors encountered. You will have time to write 
the info down if an error was found. You must press F7 
after error to continue with copy process. 

FASTBACK PROCEDURE 

1.. .LOAD and run T/S analyzer. Follow PROMPTS. Make error 
printout if desired. SAVE error log on disk reserved 
for that purpose. 

2.. .LOAD and RUN FASTBACK. Follow PROMPTS. 

3.. .After copy is done, use error log and error maker or 
Diskpicker to write errors back on copy disk. 

4.. .As an alternate to error writing, try to disassemble 
original program and remove error checking routines. As 
these routines may be in the boot, you may need to use 
Relocate/Loader to get into these routines. 

RELOCATE/LOADER PROCEDURE 
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1.•.LOAD and RUN RELOCATE/LOADER. 

2.. .Follow PROMPTS and select program from original disk 
to be Relocate/loaded. 

3.. .Type in EXACT program name when asked for it. 

4.. .5.ve the Relocated copy. If you are trying to pick the 
program you can load Editor /Assemblers or other tools 
needed for picking. The relocated copy can be loaded as 
often as needed for study purposes. It will have a 
starting address of $0A00 or decimal 2560. You do not 
need to change the start address until you are done 
"picking". While picking, you can save the program as a 
normal machine language routine. 

5.. .1. relocating has been done to COPY and if you have 
completed any needed changes and now need to reset 
address, go to the DISK-EDITOR PROCEDURE. 

DISK-EDITOR PROCEDURE 

1.. .LOAD and RUN DISK-EDITOR. 

2.. .Follow PROMPTS and select track and sector desired to 
edit. IF RESETTING ADDRESS, this will be the first 
track and sector for the program. If you do not know 
which is the first track and sector you will need to do 
a Superdirectory listing to find out. 
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3.. .0nce desired sector has been loaded, you will have i 
display with the hex values of each byte in the sector. 
The first two are green and are the NEXT TRACK and 
SECTOR values IN HEX. (Convert these to decimal to find 
next track and sector and convert any desired values to 
hex before trying to replace current ones) For example 
if next track and sector is given as 17 10; the 
decimal value is 23 16. If you wish to change this link 
to. to say track 1 sector 12 you would type in 01 0C. 

4.. .1f you want to change the LOAD-TO address, it is given 

in the 3rd and 4th bytes. (Two following the green 
ones) Remember this only applies to the first sector of 
the program, all others contain data in this location. 
The values are in hex with the low byte first and the 
high byte second. If you are looking at a 

relocate/saved copy, you would see in this location 
these numbers: 00 0A Which means that the program 

will load to location $0A00. If you are resetting the 
address back to what is used on the original disk, look 
up the correct start address from the HEX.ADD column of 
your Superdirectory listing of that disk. 

5.. .0nce all desired changes have been made, follow the 
PROMPTS to either SAVE changed sector or get another 
one. SAVED sector will replace itself on the disk. 
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DISKPICKER PROCEDURE 

The uses of Diskpicker go well beyond what a 
simple procedure can give you. As it is a system that 
allows you to develop programs to use in the disk, we 
will explain how to use the options and give you some 
example error routines which you can send to the disk. 
Beyond this, you will need fluency in machine language 
to be sucessful. Note that you must obtain a copy of 
MONITOR$8000 which should be saved on your PSIPACK 
disk. Other monitors may be used if you want to change 
the program lines that load and call MONITOR$8000. 

(SYS32768 is the call). Remember that other monitors 

cannot occupy the beginning of basic RAM or $C000 

locations. You will need some free RAM to use as buffer 

space for developing routines and for storing 

information read from the disk. Typically a couple of K 
will be enough. 

1.. .LOAD and RUN Diskpicker. 

2.. .MENU OPTION 1 - Transfer disk memory to buffer. 

The purpose of this option is to allow any valid 
locations in the disk drive to be transfered to the 
memory of the C64 from where you can dissassemble, 
study, and modify as desired. The monitor printer 
options will allow you to make printouts of this 
memory. Since the total RAM in the disk is only 2K in 
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size, you havo plenty of room in tho 64 for this 
purpose. The requirements of Diskpicker do limit you to 
using memory between $3000 and $7FFF which is 20K. 

Option one will ask for the starting and ending 
DISK locations you want to transfer to the C64. These 
must be in HEX! It will then ask you where you want the 
C64 buffer which will recieve the data to be. We 
STRONGLY recommend that you always use the same page 
offset. Thus if you want to transfer disk $0300-$03FF 
to the C64 you should use a buffer start such as 3300 
or 4300 or 5300 etc. This will make disassembly more 
meaningful because all page addresses will be the same. 
NOTE: We define 00-FF as location address; 000-F00 as 

page address? and 0000-F000 as block address. 

2...MENU OPTION 2 - Enable Monitor Mode. 

This option puts you into the editor assembler. We 
. use Monitor$8000 (by Commodore) for this purpose. The 
typical E/A features are available in this mode. For 
example, you can select a memory area and write a 
machine routine which can be transfered to the? disk by 
option *3. When looking at information that you have 
loaded from a disk through disk memory, we recommend 
using the I (interrogate) command which will give you 
an ASCII as well as hex dump. This can be useful when 
looking for acess codes or particular info which would 
be meaningful in ASCII. Keep a copy of figure 3.3 (disk 
map) handy when using the monitor. 

To EXIT the monitor mode, type G C020. This will 
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return you to the main menu in basic mode. Your 
programs or data that you were working on will remain 
intact as long as you do not try to transfer something 
on top of them or erase them with a monitor command. 
This gives you the ability to keep many "images" of 
disk memory or machine routines in memory at one time. 

3.. .Transfer Buffer to Disk Memory 

This option allows you to send the data or program 
that you have in the C64 buffer space TO the disk drive 
memory. Remember that the disk uses $0000 to $02FF for 
system purposes and you will not normally transfer 
programs to these locations. The buffers in the disk/ 
0300/ 0400, 0500, 0600, and 0700 are perfect for such 
uses. S 

4.. .Direct Execute User Program. 

Assuming you have transferred a program to the 
disk drive, this option will allow you to cause that 
program to be executed! You will be asked for the 
address (hex) in the disk at which you want execution 
to begin. The proper commands will be sent by 
Diskpicker to cause that program to RUN in the disk 
memory* It is a good idea to make sure a scratch disk 
is in the drive the first few times you try a routine 
in case it backfires. 

Direct Execute is primarily for routines which 
manipulate data rather than routines which control 
reading or writing to sectors. The reason for this is 
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that direct execute does not provide for automatic 
track and sector preparation as does Job Que Execute. 

5...Job Que Execute. 

This option provides execution of your routine AS 
A PART OF one of the EXISTANT DISK ROUTINES. In other 
words, if you select lets say a Job Que WRITE, the 
drive will find the track and sector you have selected, 
and then execute your routine. Normally your routine 
would be designed to affect what might normally have 
been done through the disk routines. The job que 
functions save you the trouble of trying to get the 
motors going, find track and sector, etc. 

The following list gives the direct execute 
commands s 

128-READ -Reads in selected sector. 

144-WRITE -Writes to selected sector. 

160-VERIFY -Compares sector with one in memory. 

176-SEEK TRACK -Locates specified track. 

184-SEEK SEC -Locates specified sector. 

192-BUMP -Runs head to stop and bumps (resets head) 

208-JUMP -Jumps to specified memory location. 
224-EXECUTE -Puts Track and Sector to be affected in 
Que, finds track and sector, loads the header there and 
goes to your machine routine. Note that your machine 
routine or its jump vector must start at the beginning 
of one of the five buffers, $0300 through $0700. Since 
data is read from the disk header, variables in the 
drive memory will be affected. 
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6.. .Load Sector To Disk Buffer 

This option will ask you for the headers (track 
and sector) and will then load that sector to the disk 
memory. From there it can be transferred to C64 Memory 
for study. This option is useful to examine specific 
sectors. 

7.. .1.itialize disk I/O 

This is essentially a RESET command which returns 
the disk to power up conditions. It does so without 
wiping out all of memory like a C64 RESET would do. 
Useful when you need to be sure the disk is clear for 
other operations. It is a good idea to use this 
command any time you have uncovered and error and wish 
to send new commands to the disk. This makes sure the 
disk is ready to receive the data properly. 

8.. .Format Diskette. 

This option allows to format a diskette without 
breaking out of program. This can be useful since you 
will typically be trying to do things which can "mess" 
up your practice scratch disk! 

9.. .Resetting. 

If the system locks up, use SYS49184 for a- warm 
reset. In extreme cases you may need a reset button or 
turn off the computer. (See Appendix E). X is used to 
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escape an input mode question 


ADVANCED TECHNIQUES 

In making protection, there are some things which 
go beyond simply writing an error and having the 
program test the error by trying to load the sector. 
Error writing programs to date leave you with little other 
option. There are many things possible of which we will 
try to start you thinking about a few. 

Consider first, how a disk sector or partial 
track could be erased. The disk would normally find 
this sector by its header, which can't be done if it 
has been erased. However, if you know which sector is 
bad, you can tell the disk to look for the sector in 
front of it, which is good. Once the preceeding good 
sector is found, the disk is programmed to wait for a 
certain period and write some data. This data then goes 
to the "nonexistant" sector. A similar process can be 
used to read this data. A quite effective means of 
protection since it is difficult to reproduce the exact 
parameters used to write the data! This variation can 
be used on the "extra” tracks beyond 35. 

Other ways to protect include putting data in the 
GAP at the end of a track. If your copy maker is not 
aware that data is there it will not look there. With 
the machine routines we have included, the gap data can 
be road in a fashion similar to the above process. 
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Tracks and Sectors can be given illegal numbers by- 
changing this data in the header. (Appendix F) The 
normal DOS will not accept out of range values. A 
machine routine used by the disk drive can do this. The 
diskette could also be entirely or partially formatted 
in an abnormal pattern which would only be recognized 
by a modified DOS routine. 

Another devious means would be to write "encoded" 
sync pulses on an unused part of the disk. These sync 
pulses could be encoded by a means as simple as 
spacing. In other words , the time between consecutive 
sync pulses would have to be exactly according to a 
predetermined VARIABLE spacing/ or the program checking 
them would abort. Breaking such a system would require 
a sophisticated analysis of the diskette which cannot 
be done through normal DOS routines. 

These examples should give you a clearer idea of 
what can be done if you go outside the confines of the 
DOS and develop both reading and writing routines. It 
is hard enough to understand how the normal DOS 
routines function/ let alone trying to figure out what 
someone has done beyond this. These methods by nature 
will not be compatible with other drives. It is also 
interesting to note that copier programs usually will 
not copy themselves... in other words they are 
obsoleted by their own manufacturers since they have 
developed protection that foils their OWN product!! If 
they can do it, so can anybody else. If a copy program 
cannot copy itself, you may rest certain that within a 
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VERY short time there will be many new programs out 
that it also cannot copy! If the market continues to 
develop in this direction, we will likely continue with 
our development of a disk "Dumb Copier". Such a system 
will put to rest any protection that does not involve 
external hardware or physical modification of the disk 
drive. 

ERROR WRITING PROCEDURE 

Following are some examples of how to send error 
writing routines to the disk via Diskpicker. In the 
program section of this chapter we have listings for 
all the error routines included. You may prefer to 
write a basic program which "sends" these routines to 
the disk and then executes them. We have chosen not to 
as such error writers are abundant already and become 
outdated as fast as they are sold. If you become 
familiar with the techniques of Diskpicker, you will be 
able to add and modify routines as YOU see fit. 

IMPORTANT: Although every attempt was made to make 
these procedures compatible with all 1541s, there are 
apparently four revisions of the DOS ROM put out by 
Commodore. As explained earlier, this can lead to 
compatibility problems with many forms of protected 
software AS WELL AS error making procedures. This is 
why such protection is of questionable validity. We 
can not guarantee that all error making routines will 
work on all past and future versions. 
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SPECIAL INSTRUCTIONS AND CAUTIONS 

NOTE:These techniques should not be attempted if you do 
not understand the underlying principles. 

Indiscriminate use could cause the disk head to stick 
which may require partial disassembly to correct!! 

1. To Escape back to Main Menu, Input letter X for 
requested input value. 

2. To escape from Monitor$8000, input G C020. (requires 
space btween G & C020) 

3. If disk or computer locks up, (and if you have a reset 
button), press reset and enter SYS49184 to restore 
system. 

4. Always Format disk to be written to with the same disk 
ID# as the original. 

5. Never select tracks above 44 or disk head will bang 
against end stop and may get stuck. If this happens you 
will need to open disk case and gently push head back 
to center. 

6. If head gets stuck, first try by using Initialize 
operation or call the Job Que Bump command, #192. 

7. Always input valid header # and data for track & sector 
when using the Job Que. 

ERROR 20 NO HEADER 


Erases header from specified track and sector. 

1. Load and run Diskpicker. 

2. Select menu option 2. Set printer choice "N". 

3. Input L”20 NO HEADER”,08 After load. Input G 

C020. 

4. Place diskette to be written on in drive. 

5. Select menu option 7. 

6. Select menu option 3. 

7. Input disk start address 0300. 

8. Input disk end address 034F. 

9. Input Buffer address 3300. 

10. After Data transfer to disk, select menu option 5. 

11.Input Job choice 224. Select choice 1 (0300) for 
execute address. F 0R ONE SECTOR SET MULT I SECTOR*'N* 

FOR ALL SECTORS. SET MULTISECTOR^'Y' 
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12.For header #1, input track # desired to write ON 


13. For header#2, input value ONE LESS than sector desired 
to write ON. (USE 0 FOR SECTOR #s 1) 

* Note: If sector 0 is to be written to, select the 
highest sector number on this track. (see drive user 
manual). i.e.: Input a 20 if sector 0 on track 1 is 
being chosen. 

14. REPEAT the above steps 8-11 for writing type 20 errors 
to other headers of your choice. * Intermixing read, 
write and load operations may write over the error 
routine being held in the disk memory buffer. 

15. To test your errors, select option 5 (Job Que Execute). 


16.Input job choice 128. 

17.For header #1 , enter track #desired to read, and for 
header#2, enter the sector number to read. 

18.If everything went right, you will see the proper error 
message and OP status code. 

** For error routines 21 ERASE TRACK, 22 NO DATA, 23 
DATCHKSUM, and SYNC WRITER, repeat the same 
instructions as given above EXCEPT select the EXACT 
track and sector #s you wish to write on. (No wrap 
around is needed on sector 0) The SYNC WRITER routine 
is usually used to write sync pulses to tracks from 35 
thru 44. This will change the error returned when 
reading these areas from sync not found to HEADER NOT 
FOUND. 


READ HEADER 


This routine reads the GCR header from a disk and 
allows you to put it in the computer for analysis or 
modification. By using this routine and the HDR WRITE 
you can "SPLICE" bad headers from original disks on to 
your copy disks. In many cases this is more effective 
than trying to reproduce the header errors that have 
been used for protection. 

1. Load and run Diskpicker. 

2. Select Menu option 2 and printer choice "N". 

3. Input L"READ HDR",08 after load, input L"C0PY 

HDR",08 

4. After load, input. (J C020 

5. Place diskette to be read into drive. 
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6. Select menu option 7 then option 3, 

7. Input disk start address 0300 

8. Input disk end address 034F 

9. Input buffer address 4300 

10. After data transfer, select menu option 5. 

11.Input Job choice 224 and select choice 1 for execute 
address Of 0300. FOR ONE SECTOR, MULTISECT0R*'N' FOR ALL 
SECTORS MULTISECTOR**' Y ’ 

12. For header #1, enter track header you wish to copy is 
on. 

13. For header #2, enter sector value ONE LESS than sector 
value with header you want, ie: Input 0 if sector 1 was 
choice. 

** For sectors 0, seiect last sector on that track!. 

14.Select menu option 1. 

’ 15.Input disk start address of 0400. 

16.Input disk end address of 05FF. 

17.Input buffer address of 6400. 

18. After data transfer, select menu option 2 and desired 
printer option. 

19. Use memory dump command ( M ) of monitor to display GCR 
image of the header and data now contained in computer 
memory locations from 6400 to 65FF. See Appendix F for 
explanation of GCR image. G C020 will return you to 
main menu. 


COPY HEADER 


Writes GCR image of header from disk buffer to 
object diskette. Useful for ERROR SPLICING. 


1. Follow steps 1-19 for Read Hdr routine. 

2. Insert disk to be written to in drive, (object disk) 

3. Select menu option 3. 

4. Input disk start address 0300. 

5. Input disk end address 035F. 

6. Input buffer address 3300. 

7. After transfer of program to disk, select menu option 
5. 


145 



8. Input Job Choice 224 and select choice 1 for execute 
address of 0300. FOR ONE SECTOR» MULTISECT0R='N' FOR ALL 
SECTORS MULTISECTOR='Y ' 

9. For header #1/ enter the track header is to be written 
to. 

10. For header#2, enter sector value ONE LESS than desired 
sector to be written to. ie: Input 0 if 1 is your 
choice. 

* If choice is 0, use highest sector value on THAT track, 
as described in other procedures. 

11.If everything went right, you can use READ HDR steps 5 
thru 19 to look at and verify the new header just 
written!! 


EXTRA NOTES 


Remember, Diskpicker is designed to give you 
control of exactly what is written and sent to the 
disk. It is a disk development system especially for 
experimenting with and testing modified DOS routines. 
Do not confuse its intent with that of "turnkey" error 
writers which are simple to use but restrict you to 
what they have decided should be used for errors. Such 
programs are obsolete shortly after they are sold. With 
Diskpicker you can concentrate on collecting modified 
DOS routines which are by nature short and easily 
traded, and use Diskpicker to transfer and execute 
these routines. Dedicated error writers generally try 
to keep you from getting into the program let alone 
modify and update it. 

Below are listed some protection possibilities to 
look for on original diskettes: 

1. Missing or extra sync bytes. Use READ HDR to look for 
this. 

2. Missing header or illegal header ID. 

3. False header checksum. 

4. Illegal or missing sectors. 

5. False ID numbers. 

6. Protection data in GAP area. 

7. Missing or illegal data block ID byte. 

8. Data block missing. 

9. False data checksum, 
data in end of track GAP. 
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10.Protection 
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11•Protection data encoded using sync pulse 
combinations. 

♦Note: It is possible to achieve some of the above 
errors on tracks 36 thru 44 as these are readily 
available using the disk controller software. 

Even though protection errors will cause loading 
problems under normal conditions, it is a fairly simple 
process to recover useable data from a bad sector. This 
is done by analyzing the error and writing a short 
machine program to recover the data. The trick is to 
sync up on a previous sector's sync pulse and count 
bytes to the location you wish to read from. When 
counting bytes, sync pulses show up as ONE byte even 
though several have occurred. A valid sync pulse does 
not always show up on a GCR sector read out as an "FF". 

The general philosophy for precise error writing 
is to place the GCR data you wish to record in one of 
the disk memory buffers, find a valid sync pulse on a 
nearby preceeding sector, count bytes up to the area 
you wish to write to, switch the disk controller to its 
write mode and dump the buffer to the diskette. 
Switching from read to write is Best accomplished 
during the gap time when GCR 55's are being read. 

The read/write techniques just described will 
allow a clever programmer to read or write desired 
information to/from any place on the diskette!! Good 
luck!!! 


*** IMPORTANT: When switching diskettes during 
Diskpicker procedures, be sure to perform 
Initialization - Menu option seven. This will insure 
that the drive page zero memory locations are 
initialized to the current diskette identification 
parameters. THIS DOES NOT HAPPEN ON POWER UP! 
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CREATE HEADER ERRORS 


1. For checksum error in header, load ICON HDR through 
monitor mode of Diskpicker. 

2. If checksum in header error is not desired, load CONHDR 
through monitor mode. 

3. Load WRITE HDR through monitor mode. 

PUT OBJECT DISKETTE IN DRIVE. 

4. Select 6 from main menu and enter track# and sector# 
desired. 

5. Select choice 1 - (Transfer disk mem. to buffer) 

Start addr. 0000 

End addr. 00FF 
• Buff. addr. 6000 

6. Interogate memory locations 6000 -6030 form monitor 
mode. Refer to Appendix F "Important Disk Memory 
Locations" to identify byte functions. 

7. Change locations to value desired to create errors. 
Disk ID #s might normally be changed. 

8. The GCR image of this hdr can be seen in computer 

buffer locations 6024-602B. (Which come from disk 

memory 0024-002B) SELECT 3 FROM MAIN MENU START ADDR 0016 

END ADDR 001B BUFF ADDR 6016 

9. Select 3 from main menu. 

Start addr. 0300 

End addr. 031F 
Buff. addr. 5300 

10.Select 4 from main menu. Entry addr. 0300 

11.GCR image is now in disk memory locations 03E0-03E7, 
ready for transfer to the object disk. Make sure object 
disk is inserted in drive. 

12.Select 3 from main menu. 

Start addr. 0300 
End addr. 036F 
Buff. addr. 3300 

13. Select 5 from main menu. Job choice = 224. For 

execute start addr, select 1 (0300) 

14. For Hdr #1, use track desired. For Hdr#2, use ONE 

LESS than desired. ("wraparound as in earlier 

procedures), io: For sector 1 enter a 0. 

15. To check errors, follow read header techniques. 
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1PSIMAIN 


1 SVS49891 ; P=0 

2 SVS49844 

3 SVS49516=X=PEEK<49160>0NXG0T04/3/5/18 

4 T=PEEK<49156):S=PEEK <49157)=PRINT#15/"U1•"2; 0;T;8:G0SUB25=SVS49691 : GOT03 

5 37349858=2=0 

6 37849939=X=PEEK<49161> : 0NXG0T07/ 6/ 2/19.5 

7 T=PEEK<49158):3=PEEK<49159):SYS49745:IFPEEK<49173)==1RNDZ=1 THEH6 

8 PRINT#15/"B-P ="2;0 =37349718 : PRINT#15,"U2 : "2;0;Ti3:G0SUB25=2=1 : G0TO6 
10 SVS49872 : END 

25 PRINT"OTRK. M T"I1 " =PRINT"WSEC. ,, 3 ,, ll "• INPUT# 15,R$, B* 

26 PRINT"WERR. ,, flS ,, ^^TTTTT ,: I FR$=“00"THENRETURH 

27 IFP= 1THEN0PEN4/ 4= PRINT##* T/ S/ fi$/ BS = CL03E4 

28 S7S49903=RETURN 

2PSIMAIN 


1 SVS49778=P=0 

2 37S49816 : M=0 

3 SVS49516 : X=PEEK <49160) : 0NXGQT04>3/5/10 

4 T=PEEK<49156)=S=PEEK<49157)=PRINT#15/"U1:“2;0;T;S=GOSUB25=37349691:G0T03 

5 3VS49832:M=1=2=0 

6 37549604 : X=PEEK<49161) : 0NXG0T07>6/2/ 10/5 

7 T=PEEK<49153) =S=PEEK<49159) : SVS49745 : IFPEEK<49173>=1RNDZ=1THEN6 

8 PRINT#15/"B-P:"2i0 = SVS49718•PRINT#15/"U2 ="2;0;T;3 = G0SUB25 = 2=1 G0T06 
10 3V349848 : END 

25 PRINT"4OTRK. "T"ll "=PRINT"W3EC. "S"II " = INPUT#15/fi$.. B$ 

26 PRINT"*ERR. "fl$"TTTnT = IFfi$='‘08"THENRETURN 

27 IFP=1THEN0PEN4/4 = PRINT#4/T/3/R*/B %■ CLQSE4 
23 IFM=0THENS7S49867=RETURN 

29 3VS49877:RETURN 
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DUPDAC DATA 

:C008 00 00 OB OB 11 F8 11 23 
:CO10 03 OF 23 08 09 00 00 00 



1DUPDAC 









C018 

R9 

00 


LDR 

#$00 

0087 

00 



BRK 


C01R 

85 

FB 


STfi 

$FB 

0083 

00 



BRK 


C01C 

85 

FD 


STR 

$FD 

0089 

00 



BRK 


C01E 

R9 

0R 


LDR 

mm 

C08R 

00 



BRK 


C020 

35 

FC 


STR 

$FC 

C03B 

R9 

0fl 


LDR 

#$0fl 

C022 

85 

FE 


STR 

$FE 

C03D 

35 

FC 


STR 

$FC 

C024 

R0 

00 


LDV 

#$00 

C08F 

85 

FE 


STR 

$FE 

C026 

R9 

00 


LDR 

#$00 

0091 

R9 

02 


LDR 

#$02 

C023 

99 

00 

C0 

STR 

$C000,V 

0093 

20 

03 

FF 

JSR 

$FFC3 

C02B 

C3 



IHV 


0096 

R9 

0F 


LDR 

#$0F 

C02C 

C0 

0fl 


CPV 

#$0fl 

0093 

20 

03 

FF 

JSR 

$FFC3 

C02E 

D0 

F3 


BNE 

$0023 

C09B 

60 



RTS 


0030 

RD 

0R 

C0 

LDR 

$C00fl 

0090 

00 



BRK 


C033 

3B 

20 

D0 

STR 

$0020 

C09D 

00 



BRK 


C036 

.RB 

0B 

CQ 

LDR 

$C00B 

C09E 

00 



BRK 


0039 

SB 

21 

D0 

STR 

$D021 

C09F 

00 



BRK 


C03C 

RD 

11 

C0 

LDR $0011 

C0R0 

R9 

0F 


LDR 

#$0F 

C03F 

8D 

18 

D4 

STR 

$D413 

C3R2 

RE 

14 

00 

LDX 

$0014 

C042 

RD 

0C 

C0 

LDR 

$C00C 

C0R5 

R0 

0F 


LDV 

#$0F 

C04S 

3D 

05 

D4 

STR 

$D405 

C0R7 

20 

BR 

FF 

JSR 

$FFBR 

C048 

RD 

3D 

C0 

LDR 

$C00D 

O0RR 

R9 

00 


LDR 

#$30 

C04B 

3D 

06 

D4 

STR 

$0406 

C0RC 

20 

BD 

FF 

JSR 

$FFBD 

C04E 

RD 

10 

C0 

LDR 

$0010 

C0RF 

20 

00 

FF 

JSR 

$FFC0 

C051 

3D 

00 

D4 

STR 

$D400 

C0B2 

R9 

02 


LDR 

#$02 

C054 

RD 

0F 

C0 

LDR 

$C00F 

C0B4 

RE 

14 

00 

LDX 

$0014 

C057 

3D 

01 

D4 

STR 

$D401 

C0B7 

R0 

02 


LDV 

#$02 

C05fl 

60 



RTS 


C0B9 

20 

BR 

FF 

JSR 

$FFBR 

C05B 

00 



BRK 


C0BC 

R9 

01 


LDR 

#$01 

C05C 

00 



BRK 


C0BE 

R2 

12 


LDX 

#$12 

C05D 

00 



BRK 


0000 

R0 

00 


LDV 

#$00 

C05E 

R9 

0F 


LDR 

#$0F 

0002 

20 

BD 

FF 

JSR 

$FFBD 

C060 

RE 

13 

C0 

LDX 

$0013 

0005 

20 

00 

FF 

JSR 

$FFC0 

C063 

R0 

0F 


LDV 

#$0F 

0003 

60 



RTS 


C065 

20 

BR 

FF 

JSR 

$FFBfl 

0009 

00 



BRK 


C063 

R9 

00 


LDR 

#$00 

O0CR 

00 



BRK 


C06fl 

20 

BD 

FF 

JSR 

$FFBD. 

O0OB 

00 



BRK 


C06D 

20 

C0 

FF 

JSR 

$FFC0 

0000 

00 



BRK 


C070 

R9 

02 


LDR 

#$02 

C0CD 

13 



CLC 


C072 

RE 

13 

C0 

LDX 

$0013 

C0CE 

R2 

00 


LDX 

#$00 

C075 

R0 

02 


LDV 

#$02 

C0D0 

BD 

F0 

CD 

LDR 

$CDF0, 

C077 

20 

BR 

FF 

JSR 

$FFBfl 

C0B3 

09 

04 


CMP 

#$04 

C0i'fl 

R9 

01 


LDR 

#$01 

C0D5 

F0 

06 


BEQ 

$C0DD 

C07C 

R2 

12 


LDX 

#$12 

C0D7 

20 

D2 

FF 

JSR 

$FFD2 

C07E 

R0 

C0 


LDV 

#$C0 

C0DR 

E3 



I NX 


C080 

20 

BD 

FF 

JSR 

$FFBD 

O0DB 

D0 

F3 


BNE 

$C0D0 

C083 

20 

C0 

FF 

JSR 

$FFC0 

C0DD 

60 



RTS 


C086 

60 



RTS 


C0DE 

00 



BRK 








C0BF 

00 



BRK 








C0E0 

18 



CLC 








C0E1 

R2 

00 


LDX 

#$00 







C0E3 

BD 

30 

CE 

LDR 

$CE8C, 







C0E6 

09 

04 


CMP 

#$04 







C0E8 

F0 

06 


BEQ 

$C0F0 







C0ER 

20 

D2 

FF 

JSR 

$FFD2 







O0ED 

E3 



I NX 








C0EE 

D0 

F3 


BNE 

$C0E3 







C0F0 

63 



RTS 








C0F1 

18 



CLC 








C0F2 

R2 

00 


LDX 

#$00 







C0F4 

BD 

E0 

CE 

LDR 

$CEE0, 
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c 

c 

c 

c 

( 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 
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c 

c 

)C 

c 

c 
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CDF3 20 

05 

72 

72 

72 72 72 72 

CFE0 

IF 

02 

11 

20 

00 

11 

21 

00 

CE00 72 

72 

72 

72 

72 72 72 72 

CFE8 

11 

22 

00 

11 

23 

00 

11 

FF 

CE03 72 

72 

72 

72 

72 72 72 72 

CFF0 

BB 

00 

00 

00 

00 

00 

00 

00 

CE10 72 

72 

72 

0D 

20 20 20 20 

CFF3 

00 

00 

00 

00 

00 

00 

00 

00 


CE13 20 20 20 20 05 43 20 36 
CE20 34 20 44 49 53 4B 20 42 
CE23 41 43 4B 2D 55 50 20 32 
CE30 44 55 50 44 41 43 0D 20 
CE38 20 20 20 20 20 20 20 05 
CE40 33 fl3 33 33 33 33 33 33 
CE48 33 33 33 33 33 33 33 33 
CE50 33 33 33 33 33 33 33 33 
CE53 33 0D 20 20 20 20 20 20 
CE60 20 20 20 20 20 20 20 IE 
CE63 23 43 29 20 50 53 49 44 
CE70 41 43 20 9E 31 39 38 33 
CE73 0D 11 9F 9F 42 59 20 56 
CE80 49 43 20 4E 55 4D 42 45 
CE83 52 53 0D 04 11 11 11 11 
CE90 9E 23 20 23 20 49 4E 53 
CE93 45 52 54 20 4F 52 49 47 
CE30 49 4E 41 4C 20 44 49 53 
CE38 4B 20 49 4E 20 44 52 49 
CEB0 56 45 20 23 20 23 0D 04 
CEBS 11 11 11 11 @5 23 20 23 
CEC0 20 49 4E 53 45 52 54 20 
CEC3 43 4F 50 59 20 44 49 53 
CED0 4B 20 49 4E 20 44 52 49 
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SUPERDIRECTORY 


5 IFA=0THENfi-l:LOAD”ADMACH",8,1 

18 POKE53280,11:P0KE53231,11=TR=18 SE=1:DIMA<300> = DIMB <200> 

15 HX$="0123456789ABCDEF" 

18 P=0 : 1NPUT"DaPRIHTER V/N";VN$:IFVN$s"V"THENP=l 
20 PRIMT'Tlil SUPERB I RECTORVil <034 P3IDAC VBNa" 

25 I FP= 1THEM0PEM4,4 = PR I NT #4 = PRINT#4,CHR$< 16 > " 15SUPERDI RECTOR V" : PR I NT #4: CL0SE4 
30 PRINT"MINSERT SOURCE DISK IN DRIVE" 

35 INPUT"MDISK NAME";BN# 

40 IFPD S 1THEN50 

41 PRINT"MIPRESS F7" 

42 GETA$:IFA#0 ,, II"THEH42 

45 IFP=1THEN0PEN4,4 : PRINT#4,"DISK NAME = "DN$ : PRINT #4 CL0SE4 

50 0PEN15,3«15 : 0PEN2/3*2/ : PRINT#15*"U1 : "2;0;TR;3E 

60 SVS49152 

70 CL0SE2 1 CLOSE15 

80 FORRP=0TO255 

100 A ( RP ) =PEEK <RP+52992 ) 

120 NEXT 

125 TR=A<0) : SE=A<1) 

130 PRINT'TWTVPE TRACK SECTOR NAME BLKSM" 

132 IFPD S 1THEN0PEN4,4 : GOTO138 

133 IFP01THEN136 

134 0PEN4,4:PRINT#4,"TYPE TRACK SECTOR NAME ELKS" : PRINT#4 

136 IFP=1THEHPD=1 

133 F0RRP=2T0226STEP32•0K=1:FT*=" 

133 TK=A<RP+1):3K=A<RP+2>:NB*A(RP+28):IFTK=0THENCLOSE4:GOTO200 

148 IFA<RP>=s0THENFT$=‘"DEL" : 0K=1 

145 IFA<RP)»130THENFT*a"PRG" : 0K=1 

150 IFA<RP>=132THENFTf="REL" : OK=0 

155 IFA<RP>=*129THENFT$ a,, SEQ" : OK=0 

160 PRINTFT*; 

165 IFP=1THENPRINT#4,FT$; 

172 PRINTTAB<5>TK;TABC12)SK> 

175 IFP=1THENPRINT#4,CHR$< 16)"07"TK;CHR$< 16)" 16"SK;CHRf < 16)"27"; 

173 IF0K=1THENB<C>=TK:BCC+l)=SK:C=C+2 

180 PRINTTAB< 18);: F0RTX=3T018: PRINTCHR*<A<RP+TX> ); : NEXT = PR INTTAB < 34 ) NB 

185 IFP= 1 THEHF0RTX=3T018• PRINT#4,CHR*<A<RP+TX>) i ■ NEXT : PRINT#4,CHR*< 16>"34"NB 

130 NEXT CL0SE4 

200 IFA < 0 ) O0THENGOT040 

300 PRINT"UPRESS F7W" 

305 GETA$ ; IFA$<> " II" THEN305 

310 PRINT"rTTRACK SECTOR HEX.ADD DEC.ADD" : PRINT 

315 IFPO1THEN320 

318 0PEN4,4 : PRINT#4 ; PRINT#4,"TRACK SECTOR HEX.ADD DEC.ADD" : PRINT#4 

313 CL0SE4 

320 PC=1 : FORRP=0TOC-2STEP2 
330 TR=B<RP):$E»B<RP+1) 

340 0PEN15>3,15 : 0PEN2,8,2^ : PRINT#15#"U1 : "2;0;TR;SE 
350 SVS49152 

360 CL0SE2:CLOSE15:PC=PC+1 

364 IFP=1THEN370 

365 1FPCO13GOTO370 
367 PRINT"*PRE3S F7JSJ" 

363 GETA$ : IFA$0 H li"THEH368 

363 PC«1 PRINT-HTRACK SECTOR HEX.ADD DEC .ADD" PRINT 


370 AL=PEEK <52994) : AH=PEEK <52995> : AT=256*AH+AL 
375 GOSUB1000 

380 PRINTTR;TAB<9>SE;TAB<13)D$;TAB<29)AT 
382 IFPO1THEN390 
335 0PEN4,4 

386 PRINT#4,TR;CHRf<16)"07"SE;CHR$<16)"16"Df;CHR$<16)"26"AT : CL0SE4 
390 NEXT 

400 PRINT"'IMPRESS F7" 

410 GETA*:IFA*O"H"THEN410 

399 RUN10 

1000 X*AT : D$»"" 

1005 D< 1 )=INT<X/4096) : X=X-<D< 1 )*4096> : D<2)*INT<X/256) = X=X-<D<2>*256) 

1010 D<3)=INT<X/16) : D<4)=X-<D<3)#16) 

1020 F0RI»1T04:D*=D*+MID$<HX*,<D<I)+l),1)=NEXT 

1060 RETURN CH ^ UQ£ THE5E LIN ES FOR NON-COMMODORE PRINTERS 
23 IFP=1THEN0PEN4> 4:PRINTH4:PRINTH4> TAB <15) • SUPERDIRECTORY" :PRINT#4:CL0SE4 


165 IFP-1THENPRINTH4,FT$ i TAB<07)TKs 

172 PRINTTAB(5)TKiTAB(12)SKi 

175 IFP®1THENPRINTR4»TAB(18)SKiTAB(24)5 

178 IF0K*1TNENB(C) =TK: B <C+l> =SK: C=C+2 % kl _ 

180 PRINTTAB(18)J:F0RTX=3T018:PRINTCHR$<A(RP+TX>)?:NEXT-PRINTTAB(34)NB 
185 IFP*1THENF0RTX*3T018:PRINTR4»CHRt <A(RP+TX));:NEXT:PRINTR4»TAB(2)NB 
386 PRINTH4,TR ? TAB(4)SE;TAB(5)D*;TAB < 7)AT:CL0SE4 
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DISK-EDITOR 


10 IFA=0THENA=1: LOAD”ADMACH" ,8,1 

20 POKE53280, 11 : P0KE53281 ,11: DIMA<300> *• DIMfl$<300) : HX$= "012345b?85RBCDEF" 

25 P=0: INPUT'TWRINTER Y/N”; VN$: IFVN$="V"THENP=1 
30 PRINT'TUI DISK-EDIT0RI1 <C) PSIDAC VBN4" 

40 IFP= 1THEN0PEN4<4:PRINT84:PRINT44,CHR*< 16)” 13DISK-EDIT0R” :PRINT#4 CLGSE4 
50 PRINT”® INSERT SOURCE DISK IN DRIVE”=INPUT”W DISK NAME”;BN* 

80 IFPelTHENOPEN4/4 : PRINTft4* "DISK NAME = ”DNS : PR I NT #4 : CL0SE4 

110 INPUT”® INPUT TRACK # ";TR:INPUT”® INPUT SECTOR # »;SE 

120 0PEN15/8* 15 : 0PEN2«8»2j "8” : PRINT#15* "U1 : ”2;0;TR;SE : SYS49152 : CLQSE2 

125 INPUT#15,A*,B*,C*,D*:PRINT”M “A*/BSjC*jD*“®” : CLGSE15 

130 FQRRP=0TO255 : A<RP)=PEEK(RP+52992) : NEXT 

140 PRINT'TT;•RP*0 : FORXA=8TO20 ; FQRVA=1T012 : GOSUB1000 : PRINTD*” ”;:RP=RP+1 
150 NEXT:PRINT” ”J : NEXT 

160 F0RRP=RPT0255 : GOSUB1000 : PRINTD*” NEXT:PRINT 

165 PRINT”TRACK "TR” SECTOR ”SE:IFP=0THEN200 
170 OPEN4,4:RP»0 

175 FGRXA=0TO20 : FORVA=1TO12 : GOSUB1000 : PRINT#4/D*" :RP=RP+1 

188 NEXT:PRINT#4/" ”:NEXT 

190 F0RRP=RPT0255 : GOSUB1000 : PRINT84jD*” ”;:NEXT:PRINT#4 
135 PRINT#4/"TRACK ”TR" SECTOR ”SE:CL03E4 
200 F0RCL=55296T055296+5: POKECL/13: NEXT 

210 SL= 1024:BL=52992:FORBC=0TO255 

220 X=PEEK<SL)=IFX=32THENSL=SL+1:GOTO220 

230 IFX>47THENX®<X-43>*16:GOTO260 

240 IFX<7THENX a < X+9)♦16 : GOTO260 

250 PRINT”:!®! ILLEGAL DATA FOUND” END 

260 POKESLi 32: SL=SL+1:V=*PEEK<SL) 

270 IFY>47THENV=Y-48 : GOTO300 
280 IFV<7THENV=V+9 : GOTO300 
290 GOTO250 

300 NT=X+V:PGKEBL,NT:BL=BL+1:POKESL,32:SL=SL+1•NEXT 
338 PRINT"3® READV DISK TO SAVE” 

340 PRINT”® PRESS F7 TO SAVE”:PRINT”® PRESS FI TO NOT SAVE” 

350 GETX* 

360 I FX$=" II” THENPRI NT ” 3” : GOTO390 
370 IFX*»”«”THENPRINT”D” :GOTO110 
380 GOTO350 

390 GPEN15,3,15 OPEN2,8,2, ,, #”:PRINT#15,”B-P : ”2;0 
400 SVS49184:PRINT#15,"U2:”2J0;TR;SE:CLOSE2 
410 INPUT#15,A*,B*,C*,D*:PRINT”M ”A*,B*,C*,D*:CL0SE15 
415 PRINT”® TO USE PGM. AGAIN PRESS F7“ 

420 GETX$ : IFX*="II M THENRUN20 
440 GOTO420 

999 END 

1000 X=A<RP) ; D* a ”” 

1O10 D1 3 INT<X/16):D*=D*+MID*<HX*,Dl+1,1> 

1020 D2=INT<X-16*D1) : D*=D*+MID*<HX*,D2+1,1) :RETURN 
FOR NON-COMMODORE PRINTERS CHANGE THESE LINES 


40 IFP=1THEN0PEN4,4:PRINTM4:PRINTR4,TAB(13)"DISK-EDITOR":PRINT1*4:CL0SE4 
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ERROR ANALYZER 


10 PGKE53280,11:P0KE53231 , U •P=4 : B=8:RT=1:HT=3 
20 DIMER$< 11):FGRRP=1TG11=READER*<RP> : NEXT 

30 DATA "ALL GK","NG HEADER FOUND".. “NO SVNC FOUND", "DATA BLOCK NOT FOUND" 

40 DAT A"CHECKSUM ERROR IN DATA","BYTE DECODING ERROR","WRITE VERIFY ERROR" 

50 DATA"WRITE PROTECT ON","CHECK SUM ERROR IN HEADER","LONG DATA BLOCK" 

60 DATA"DISK ID MISMATCH" 

80 DATA 1,17,0,20,13,24,0,18,25,30,0,17,31,35,0,16,36,44,0.15 
35 0PEM15,D,15,"10"'CL0SE15 

30 PRINT M ZK1 ERROR AHALVZERII PSIDAC(C>84 VBN" 

180 PR I NT " Hall NSERT SOURCE DISK IN DRIVE" = PR I NT "PRESS F7" 

110 GETF7$: I FF7$0 " II" THEN 110 

115 PR=0: INPUT'MPRINTER V/N" J YN$: IFYH*="Y"THENPR S = 1 
120 INPUT "MDISK NAME";BN* 

122 PRINT"3SELECT CHOICE" : PRINT"M< 1)=LOG ERRORS" 

123 PRINT" M( 2)=LOG UNFORMATTED TRACKSW" 

124 INPUTCH* : CH=VRL<XHS ) -PR I NT "MM" •ONCHGOTO128,200 

125 PRIHT"O":Q0T0122 

128 IFPR=1THEN0PEN4,P : PRINT#4," ERROR LOG FOR "BN* : PRINT#4 : CL0SE4 

140 FGRPP=1T05 : READFT,LT,FS,LS 
150 FORTC=FTTOLT•FORSC=FSTOLS = 0PEN15,D,15 
160 T=0 

170 PRINT#15,"M-U"CHR*<6>CHR*<0)CHR*<1)CHR*<TC) 

180 PRINT#15,"M-U"CHR*(7)CHR*<0>CHR*<1>CHR*<SC> 

130 PRINT# 15, "M-U"CHR*<0>CHR*<0>CHR*a>CHR*<128> 

200 PRINT#15,"M-R"CHR*<0)CHR*<0) : GET#15,A* : X**ASC<A*+CHR*<0> > : IFX>127THEN288 

202 IFX=1THEN210 

285 T-T+l: I FT ONTTHEN178 

210 CLOSE15 : PRINT"ER#"X;TAB < 6 >"TR#"TC;TAB <12 >"3E#"SC : PRIHTER*<X >"M" 

220 I FX= 1ORRT=1THEN1000 
230 IFPR=0THEN265 
235 0PEN4,P 

250 PRINT#4,"ER#"X" TR# "TC;CHR*<16)"06SE# "SC;CHR*<16)"24"ER* < X> : CLOSE4 
260 GOTO1000 
265 GOSUB2000 
280 GOTO1000 

300 IFPR=1THENQPEH4, P '• PRINT#4, "UNFORMATTED TRACK LOG FOR "DM*: PRINT#4 ; CL0SE4 
310 F0RTR*=1T044:0PEN15,D, 15 

320 PRINT#15,"M-W"CHR*<6>CHR*<0>CHR*<1>CHR*<TR> 

330 PRINT#15, "M-W"CHR*(7 j>CHR*<0>CHR*< 1 )CHR*<0’) 

340 PRINT#15,"M-l.rCHR$<0>CHR$<0>CHR*a>CHR$<128> 

350 PRINT#15,"M-R"CHR*<0>CHR*<0> : GET#15,A* : X=ASCCA*+CHR*<0> > : IF5O127THEN350 
360 CLOSE15 

365 FM*="SVNC FOUND":IFX=3THENFM$="UNFORMATTED" 

375 PRINT"TRACK "TR;TABC12)FM* 

335 IFPR=» 1AHDX=3THEN 0PEN4,PPRINT#4,"TRACK "TR;CHR*<16> ,, 12"FM* CL0SE4 
398 NEXT : GOSUB2000 : G0T085 
999 END 

1800 NEXT : NEXT : NEXT 

1018 GQSUB2000 : G0T085 

2808 PRINT"fiPRESS F7 TO CONTINUEW 

2010 GETF7$: IFF7$O"II"THEN2010 

2020 RETURN 

INSERT LINE 112 OPEN13,D, 13, M I0" :CLOSE 1 3 
CHANGE FOLLOWING LINES FOR NON-COMMODORE FR INTERS 

250 PRINTH4,-ERtt-X' TR# *TCiTAB<06>'SE# "SCjTAB< 24>ER*<X>:CL0SE4 
385 IFPR= 1 ANDX=3THEN OPEN4, P: PRINTH4," TRACK n TR;TAB(12>‘FM$:CL05E4 


NOTE: The Following options For Error Analyzer are 
included For your beneFit: 

LINE 10 RT=0 For STOP on ERROR, or RT=1 to run through. 
LINE 140 For non-extended (0-35) "Formatted track check", 
Change PP—1 TO 5 to PP—1 TO 4. 

LINE 310 Set TR=1T044 For complete sync check. Set 
jr= 1T035 For non-extended sync check, or set TR=36T044 to 
only check "extra" tracks For sync. 

NOTE: IF DISK LOCKS UP BEYOND TRACK 35, OPEN DRIVE DOOR. 
Some diskette manufacturers certiFication methods may 
cause variations in what is "Found" in the extra tracks. 
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LINKSTER 


100^ PRINT"!! !uL INKSTER IKC) PSIDAC 1984 DU." 

110 POKE532S0,11:P0KE53281, 11:P=0 : DR»8 
128 INPUT"SPRINTER ON Y/N";PR* 

130 IFPR$*"Y ,, THENP*l:lNPUT ,, M s RO NAME" l NM$ : GOT0140 
135 IFPR* O"N"THEN100 

140 PRINT"!! SHL INKSTER IKC) PSIDRC 1984 DTk." 

150 PRINT"MENTER STARTING TRACK & SECTOR" 

180 INPUT"WTRACK";TR:INPUT"W3ECT0R"JSE:PRINT 

180 IFP= 1THEN0PEN4.• 4:PRINT#4,NM*CHR*< 13)"STARTING <TR 8EC>-"TR;SE CLOSE4 
190 LN=1 : CT=1 

208 LN=LN+1:OPEN15•DR,15 = 0PEN3,HR,3,"#" 

210 FRI NT # 15 .• " B-R "J 3;DR;TR; SE: GOTO600 

220 PRINT#15i"B-P ,, J3;0 

230 GET#3,Q*:1FQ*=" "THEHQ$=CHRS<:0> 

240 TR«flSC<Q$) : IFTF^-0ORTR>35THEN320 
250 GET#3.- U* : IFW*=" "THENU*=CHR*(0) 

260 CLOSES•CLOSE15=8E*fl3C<U*> 

270 I FP= 1 ANDLN=6THEN0PEN4 .• 4 : PRINT#4, " " : CL0SE4 
288 IFLN=6THENPRINT:LN=1 
290 PRINTTR ,, II"SE"-"J 

300 IFP»1THEN0PEN4^ 4 : PRINT#4/TR J SE" - ";:CL0SE4 

310 CT=CT +1 : OOTO200 

320 PRINT" ENDING TR/SECM" 

330 I FF'= 1THEN0PEN4 / 4 : PR I NT #4 .• " - ENDING TR/SEC" 

340 IFP=1THENPRINT#4 > CHR$<13 > CT" BLOCKS USED" : PRINT#4 ; CLOSE* 

850 PRINTCT" BLOCKS USED M" 

360 PRINT"PRESS F7 TO RUN AGAIN" : CLOSE15 : CLOSES 
370 GETCK* : IFCKiO"ll"THEN370 
380 RUN 

600 INPUT#15,ER$,B$,C*,D$:IFER**"00"THENGOTO 228 
610 PR I NT : PR I NT " iiERROR CONDITION "ER$/B$" "C*" 

620 PR I NT" '^CORRECT PROBLEM - PRESS F7" 

630 GETCK* • IFCKJK>"«"THEN630 

640 PR I NT "H m M 

650 CLOSES CLOSE15 = GOTO150 

READY. 
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RELOCATE/LOAOER 


1 IFA=0THENR=1:LOAD"MRCHRELQ" ,8/1 

2 P0KE52,10 = P0KE56,10 : POKE53280,11 : P0KE53281.. 11 

3 PRINT"38il RELO/LOADER IPSIDRC <084 VBNS" 

4 PRINTOUT ORIG. DISK IN DRIVE" 

5 INPUT"JillNPUT FILENAME" > NFS : NL=LEN<NFi) : P0KE251,NL 

6 F0RLP=1T0NL = POKES19+LP,ASC < MID$ < NFS,LP,1>) : NEXT : 3YS840 

7 EA=PEEK<175>*256+PEEK<174):PRINT":«# BVTES ="EA-2560 

8 PRINTOUT CPV DISK IN DRIVE" : PRINT"J!PRES3 F7" 

9 GETAS : IFASO"ll"THEN9 

10 PRINT" MSAVING "NFS" FROM 2560 T0"ER:3VS375:CLR 

11 0PEN15/8,15 : INPUT#15,AS,BS,CS,DS : PRINT“M"AS/BS,CS,DS : CL0SE15 
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10 IFA=0THENA=1:LOAD"ANALYMACH*,8,1 

11 OATA’ALL OK’.'NO HEADER ‘.'NO SYNC "■'NO DATA ■ 

12 DATA'DATA CHECK SUM",*X"."X" 

13 DATA'X"."CHKSUM IN HOR'.’X" 

14 DATA"BAD ID* 

13 DIMER*<11):F0RRP«1T011:READER*(RP>:NEXT 

18 P0KE54294.15:P0KE34277,17:POKE54278,248:P0KE54272,3:P0KE54273,35 
20 POKE33280,11:P0KE53281,11:SL=49152:P0KE51233,1:0=8:P=4 
30 DATA1,17,0,20,18,24,0,18,25,30,0,17,31,35,0,16 
40 C0SUB1000:0PEN15,0,15, "10" -.CL05E15 

50 PRINT*1SCHYL> T/S ANALYZER!LG) PSIDAC(C>84 VBN* 

40 PRINT * !CD )! CD HCY) # # * MENU » * tt* 

70 PRINT *< CD KWH) (1) ANALYZE T/S DATA* 

73 PRINT* I CD KWH) (2)PRINT T/S STATUS LOG* 

80 PRINT*!CD)iWH) (3)LOAD T/S STATUS LOG* 

83 PRINT "I CD KWH) (4)SAVE T/S STATUS LOG* 

TS« I ISy. T ,Zi$5il^ > SELECT CHOICE!WH)* iCH*: CH=VAL <CH*) 

100 ONCHGOTO200,400.400,803:GOTO50 

200 PRINT*!SC)INSERT SOURCE DISK IN DRIVE*:PRINT*PRESS F7" 

210 GETF7*:IFF7*O*IF7)*THEN210 
215 INPUT*!CD)OISK NAME'iDN* 

220 PRINT*!SC)IYL)T/S DATA ANALYZER ENABLED!WH)* 

230 FORPP«1T04:READFT,LT,FS,LS 
240 FORTC-FTTOLT.FORSC=FSTOLS 
0PEN13,D,13:0PEN2,D,2,*t** 

ItS £5JNT»1S.*M-W*CHR*(4)CHR*(8)CHR*(1)CHR*(TC) 
itS ESUilSi 3" M-WCHR* <7)CHR* <0)CHR* <1)CHR* (SC) 

230 PRINT815,?M-W*CHR*(0>CHR*<0>CHR*U)CHR*(128) 

7M IF8<> 1THEn” 80" CHR$<8> ° HR * <B> :GEm5,Q<:Q “ ASC<<, * +CHR * <0>): IF«> 127THEN255 

270 PRINTM1S,*U1:*2i0iTC,SC 

273 SYS31244:5S=PEEK(31232):GOSUB1000 

280 EN=Q:NM*=ER*(Q):TR=TC:SE=SC 

300 IFQOlTHENSS=Q:EC=EC+1:GOTO320 

315 NM*=*DATA*:IFSS=1THENNM*=*UNUSED* 

325 CL0SE2: G05U81005 1 P0KE8L ’ SC: SL=SL+1 POKESL, SS: SL=SL+1 

?1S fliT T , , J5^"J£SI 3)TCiTftB<8) ‘ SEC "TAB (11) SC; TAB (14) "CODE "TAB (18) SS: TAB(25) NM* 
ooO NtXT•NEXT•NEXT 

E5UiI^SS^ C ' ERR0RS COUNTED" :FORTD=1TO3000:NEXT:GOTO40 
400 PRINT*!CD)PRINT MODE ENABLED* 

2EI 1 4:PR JNTN4," « * * DISK ANALYSIS * * »" :PRINTM4 

405 PRINT84, * NAME = *DN*:PRINTI*4 
410 PRINT04,* TRK SEC CODE STATUS*:PRINTH4 
415 F0RBL-49152T05U98STEP3 
420 X»PEEK(BL):Y»PEEK(BL+1):Z-PEEK(BL+2) 

430 MS*=*READ ERROR" 

440 IFZ*0THENMS*="DATA" 

450 IFZ»1THE(01S*“ * UNUSED ” 

440 PRINT04,X!CHR*(14)"04*YiCHR*(14)*13"iCHR*(14)"12*Z;CHR*(14)"20"MS* 

470 NEXT:CL0SE4:GOTO40 

400 PRINT*ISOLOAD MODEICD)" :PRINT"INSERT STATUS LOG DISK IN DRIVE* :PRINT"PRESS F‘ 
402 GETF7*:IFF7*!> *IF7)* THEN402 

405 INPUT*ISC)TYL)INPUT STATUS LOG NAME*;NF*:DN*=NF* 

410 NL-LEN(NF*):P0KE251.NL:F0RLP=1T0NL:P0KE478+LP,ASC(MID*(NF*,LP,1)) 

413 NEXT:SYS31308:0PEN13,D.15:INPUT015,A*>B*,C*,D*:PRINTA*,B*,C*,D* 

420 GOSUB1005:F0RTD»1TO3000:NEXT:GOTO40 

||® getF 7VIFF7*O*!F7)*THEN807 INT " 1N5ERT STftTUS LOfi 0I5K IN DRIVE" :PRINT"PRESS F7 
803 INPUT *! SC KYDINPUT STATUS^LOG NAME *; NF*: DN*=NF* 

810 NL=LEN <NF*>: P0KE251.NL:F0RLP=1T0NL:P0KE478+LP,ASC(MID*(NF*,LP,1)> 

815 NEXT:SY551335:0PEN15,D,13:INPUTR15,A*,B*,C*,D*:PRINTA*,B*,C*,D* 

820 GOSUB100S:F0RTD=1TO3000:NEXT:GOTO40 

999 END 

1000 POKE54274,33:P0KE34274,34:RETURN 
1005 CL0SE15:RETURN 

CHANGE THIS LINE FOR NON-COMMODORE PRINTERS 


440 PRINTR4 ,X:TAB(02)YiTAB(02)Z:TAB(03)MS* 

NOTE: T/S Analyzer may indicate data on tracks 

containing only Format data. This will be apparent on 
some partially Full disks which indicate data in the 
First track. IF you suspect this to be the case, 
P0KE51233,0 (disk Formatted with zeros) or P0KE51233,1 
(disk Formatted with ones). 
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FASTBACK 


10 IFA=0THENA=1=LORD"ANALVMRCH",8,1 

15 PGKE52,16 : P0KE56,16:P0KE53281,11=POKE53280,11 

20 PGKE54296,15: P0KE54277,17: P0KE54278,248: P0KE54272,3 ; P0KE54273 • 35 : D=8 
30 JS=43152: JE=51198: BS=4096: BE=48983: RP=BS = HP»BS 
35 SP*=" 

40 F0RLP=lT08:REflDIS<LP) :NEXT:DRTR 0.-255,255,255,255,255,255,255 
45 GOSUB1000 : GPEN15,8,15,"10"=CL0SE15 
50 PRINT"33 FflSTBflCKil PSIDAC<C>84 VBN" 

60 PRINT"jflsHN3ERT STATUS LOO DISK IN DRIVE" : GOSUB 1050 

70 INPUT"IIINPUT STATUS LOG NAME" J NF$ : NL S LEN<NF$) : P0KE251, NL 

75 F0RLP”1T0NL : P0KE678+LP,RSC<MID$<NF$,LP, 1)> : NEXT : SVS51308 

80 0PEN15,8,15 : GOSUB1070 : GOSUB1080 

90 INPUT"3INPUT NUMBER OF COPIES";NC 

100 PRINT"3INSERT SOURCE DISK IN DRIVE" : GOSUB1050 

102 PRINT"33 READ MODE ENRBLEDWsT 

105 IFJS=JETHEH400 

110 3S=PEEK<JS+2> OK=0FORCS®1TO8:IFSS=I3<C3>THEN0K=1 : NEXT 
120 JS=J3+3 : IFOKO1THEN105 
200 IFRP=BETHEH j s»js-3:coto400 

210 TR=PEEK<JS-3):SE=PEEK<JS-2):POKERP,TR:POKERP+1,SE RP=RP+2 
220 HI=INT<RP/256> =L0=RP-<HI*256> :P0KE252,L0 = P0KE253,HI: GOSUB 1090 
240 GOSUB2000 '• PR I NT# 15, "U1 = "2;0;TR;SE:SVS51376:GOSUB1000 
250 RP=RP+256 : GOSUB1070 : GOTO105 
400 F0RCC=1T0NC 

410 PRINT"3INSERT COPV DISK IN DRIVE" : GOSUB1050 
415 PRINT"3k WRITE MODE ENABLEDJM" 

420 IFWP=RPTHEH500 

430 GOSUB2010:SV3C51452)=TR=PEEK<679):3E=PEEK<680>:WP=WP+2 
440 GOSUB2810:L0=MP-<HI*256>:P0KE252,LO:P0KE253,HI 
460 GOSUB1030 : OOSUB2000 

470 PRINT#15, "B-P: "2;0 = 3VS51404: PRINT#15, "U2: "2; 0• TR; SE = GOSUB 1000 
475 OOSUB1070:IFA$="00"THEN490 

480 GOSUB1080 : PRINT"3CLEAR ERROR THEN" : GOSUB1850 : PRINT"3" : G0T0460 

490 WP=WP+256 : GOTO420 

508 WP«BS : NEXT:IFJSOJETHENRP=BS = GOTO100 

510 PRINT "St# * * DUPLICATION COMPLETE * * $" : GOSUB1080 : RUN 15 

999 END 

1000 PQKE54276,35:P0KE54276,34:RETURN 
1050 PRINT"PRESS F7" 

1053 GETF7$: IFF7$O"«rTHEN1055 
I860 RETURN 

1070 INPUT#15,A*,B*,C*,D* 

1075 PRINT"'Jfl"SP* : PRINT"!!" R$" "B*" "C$" '’DJ^TIT' : CL0SE2 CLOSE 15 ; OPEN 15,8,15 

1078 CL0SE15:RETURN 

1080 FORTD=*1TO3000 : NEXT : RETURN 

1030 PRINTSP$ : PRINT"nTRACK ,, TAB<5)TR;TAB(10)"SECTOR ,, TAB< 15>SE : RETURN 
2000 0PEN15,D,15 : 0PEN2,D,2,"0" : RETURN 

2010 HI=INT<WP/256> :L0=WP-<HI*256> : P0KE252,LO:P0KE253,HI: RETURN 
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DISKPICKER pgl 


10 IFA=0THENA=l:LOAO*MONITORt8000*,8,1 
20 IFA*1T)CNA*2: LOAO'ZMACH* «8.» 1 
30 P0KE32* 31:POKE36.31 
33 5YS49132:RUN40 

40 POKE53280,11: P0KE53281,11: CLR: DIMERt (11): GOSUB3000 
43 PRINT*<SC><YL> DISKPICKER!LG> PSIDAC(C>84 VBNIUH)* 


50 PRINT"<CD> 


### MENU «*»' 

60 PRlNT-ICDXl) TRANSFER DISK MEMORY TO BUFFER* 

65 PRINT*<CD>(2) ENABLE MONITOR MODE* 

70 PRINT*!CD)(3> TRANSFER BUFFER TO DISK MEMORY- 
75 PRINT*!CD)(4) DIRECT EXECUTE USER PROGRAM- 
78 PRINT*<CD)(3) JOB QUE EXECUTE USER PROGRAM* 

80 PRINT"ICD)(6> LOAD SECTOR TO DISK BUFFER- 

82 PRINT *! CD ) ( 7‘* INITIALIZE DISK IO* 

83 PRINT"!CD)(8) FORMAT DISKETTE* 

84 PRINT*!CD)(9) POSITION READ/WRITE HEAD- 
83 INPUT-!CD)SELECT CHOICE*;CHt:CH*VAL(CHt) 

88 IFCH'* 9THEN40 

90 ONCHGOTO 100,300,400,500,600,700,800,900,803 
93 GOTO40 

100 PRINT"!5C)1CD)(1) TRANSFER DISK MEMORY TO BUFFERGOSUB2000 
105 INPUT*!CD)INPUT DISK START AODRESS*; X t:GOSUB1000:SA*X 
110 INPUT •< CD>INPUT DISK END ADDRESS*»Xt: GOSUB 1000: EA-X 

120 INPUT*!CD)INPUT BUFFER ADDRESS*;Xt:GOSUB1000:BA*X:IFX<8192THENGOSUB2030 
123 IFX> 32767THENGOSUB2040 

130 PRINT*!CD)DI5K MEM. TO BIFF. TRANSFER IN PROCESS*:PRINT"!CD)BYTE COUNT 
140 NB*EA-SA:5H-INT(SA/256):SL«SA-<5H#256> 

150 0PEN13,8 ?15:FORLP=0TONB 

160 PRINTM15, *M-R*CHRt (SL)CHRt (5H) :GETM15,At:PN«ASC<At+CHRt<0)) 

170 P0KEBA,PN:BA-BA+1:SL«SL+1: IFSL-256THENSL-0:SH-5H-*‘l 
175 PRINTTAB<12)LP-!CU)-:NEXT 

180 CL05E15:PRINT*1CD)!CD)END TRANSFER*:FORTD»1TO3000:^XT:RUN40 
300 INPUT *! CD )PR INTER Y/N"» YNt: IFYNt* * Y * THENP* 1 

302 IFYNt < > • Y" ANDYNt < > * N * THENPRINT - < CU >! CU )! CU )*: GOTO300 
305 PRINT:IFP*1THEN0PEN4,4:CMD4 

310 5Y532768 
320 ENO 

400 PRINT *!SC)!CD> <3) TRANSFER BUFFER TO DISK MEMORY*:GOSUB2000 
405 INPUT'!CD)INPUT DISK START ADDRESS*iX$:G05UB1000:SA«X 
410 INPUT-ICD>INPUT DISK END ADDRESS *;Xt:GOSUB1000:EA»X 

420 INPUT"!CD)INPUT BUFFER ADDRESS *;Xt:G0S1®1000:BA*X:IFX '8192THENGO5UB2030 
425 IFX)32767THENG05U82040 

430 PRINT•!CD)BUFF. TO^DISK MEM. TRANSFER IN PROCESS*.PRINT"!CD)BYTE COUNT »*i 
440 NB=EA-SA:SH=INT(SA/256):SL=SA-(SH*256> 

450 0PEN15»8»13:FORLP*0TONB 

460 PN*PEEK (BA): PRINTM15, *M-WCHRt (SL)CHRt (SH)CHRt <1)CHRt <PN> 

470 BA*BA+1:SL«SL+1:IFSL*256THENSL*0:SH*SH+1 
475 PRINTTAB(12>LP*!CU)*:NEXT 

480 CL0SE15:PRINT *!CD >!CD/END TRANSFER*:FORTD»1TO3000:NEXT:RUN40 
500 PRINT"!SC)!CD)<4> DIRECT EXECUTE USER PROGRAM*:GOSUB2000 

303 INPUT*!CD)INPUT DISK PROG. ENTRY ADDRESS**Xt:GOSUB1000:5A*X 
510 SH=INT(SA/256):SL=SA-(SH*256) 

320 0PEN15»8»13:PRINTM15»*M-E*CHRt(SL)CHRt(SH):CL0SE15 

530 PRINT*!CD)PR0GRAM EXECUTION ENABLED*:CL0SE15:FORTD=1TO3000:NEXT:RUN40 

600 PRINT *!SC)!CD > <5? JOB QUE EXECUTE USER PROGRAM*:GOSUB2000 

605 PRINT-ICDHNPUT JOB CHOICEICD)*:PRINT-128=READ*:PRINT*144=WRITE*:PRINT-160*UERIFY 
610 PRINT-176*SEEK':PRINT*184*SEC SEEK*‘.PRINT*192*BUMP*:PRINT*208=JUMP* 

615-PRINT*224=EXECUTE*:INPUT"!CD)CHOICE* ?CHt:CH=VAL(CHt):Xt*CHt:GOSUB1100 

617 IFCH*0THEN600: 

618 IFCH <)224THEN640 

620 PRINT-ISOSELECT EXECUTE STARTING ADDRESS*:PRINT*!CD)ADDRESSES AVAILABLE ARE:* 

625 PRINT*!CD)(1)-0300*-PRINT*(2)*0400-:PRINT*<3>*0500*:PRINT*(4)*0600" 

628 PRINT*(5)*0700* 

630 INPUT *ICD >CHOICE*;CHt:Xt*CHt:G0SUB1100 
632 C1*VAL(CHt):ONC1GOTO640,640,640,640,640 
635 GOTO620 
640 GOSUB2000 

642 OKt«*N*:INPUT*!CD)MULTI SECTOR Y/N*;OKt 

645 INFUT * I SC )! CD ) INPUT HEADER Ml * i Xt: TN=VAL (Xt>: IFXt=*X*THENGOSUBU00 
648 IFOKt**Y*TH€NFOR5N*20TO0STEP-1:G0T0651 

650 INPUT"ICD)INPUT HEADER M2 *?Xt:SN-VAL(Xt):IFXt«*X*THENGOSUB1100 

651 0PEN1S»8>15 

652 IFCH <> 224THEN653 

653 IFCl*lTHENPRINTM15,*M-W*CHRt(63>CHRt<0>CHRt(l>CHRt<Cl-l> 

654 IFCIO1 THENPRINTM15, *M-W*CHRt<0)CHRt<3>CHRt (3)CHRt (76)CHRt (0)CHRt (Cl+2) 

635 PRINTM13,*M-W*CHRt(6)CHRt(0)CHRt(1)CHRt(TN) 

660 PRINTM15,-M-W*CHRt(7)CHRt(0)CHRt(1)CHRt <SN> 

665 PRINTM15, *M-W*CHRt (0) CHRt (0) CHRt (1)CHRt (CH) 

670 PRINT*<CD)PPOGRAM EXECUTION ENABLED* 

675 PRINTM15? *M-R*CHRt (0)CHRt (0) :GETM15,At:OP*A5C(At+CHRt(0)): IFOP'127THEN675 
680 PRINT*!CD)TRK.*TN* SEC.*SN* OP STATUS CODE * *0P 
685 PRINT*IYL)ICD>*ERt<OP)*IWH)* 

690 IFOKt** Y * THENCL05E15:NEXT:GO5UB2000:RUN40 
695 CLOSE15:GOSUB2000:RUN40 

700 PRINT "ISO! CD) (6) LOAD SECTOR TO DISK BUFFER *: GOSUB2000 

705 INPUT"!CD)INPUT TRACK M ■?Xt:TN-VAL(Xt):GOSUB1100 

710 INPUT * I CD > INPUT SECTOR M * ?Xt :SN=VAL<Xt) : GOSUB1100 169 

715 0PEN15,8,15*0PEN2,8,2,*M* 



720 PRIN™i5,*Ul:*2>0;TN}SN:INPUT#15.At,Bt.C*,D*:PRINT“<CD>*At.Bt,Ct.D* 

725 FORTD-ITO3080NEXT 

730 CLOSE2:CLOSE15:RUN40 

800 OPEN15.8.15.*I0":CLOSE15:RUN40 

805 PRINT*<SCHCD><9) POSITION RE AO/UR ITE HEAD" :TRt**18* 

810 INPUT*<CD> TRACK WANTED*iTR*:TR«VAL(TRS):HT»TR-INT(TR):IFTRt**X*THENRUN40 

811 IFTR)41T^EN805 

815 OPEN15»8.15.*10 *:PRINT015»* M-W* CHRt(0)CHR*(0)CHRt(1)CHRt(192):CLOSE15 
817 FORTD*1TO5000* NEXT 

820 ©f»EN15»8»15:PRINm5,*M-W*CHRt(6>CHR*(0)CHR*<l>CHRt(TR> 

830 PRINT015."M-W'CHR*(0)CHR*(0)CHR*(1)CHRf(176) 

835 PRINT015. *M-R*CHRt(0)CHRt(0) 

840 CETM15.At:X-ASC(At+CHRt(0>>:IFX>127THEN840 
845 IFHT<>.5THENCLOSE15:RUN40 

850 PRINTR15.*M-R*CHR*(0)CHRt(28):GETB15.Xt:X»ASC(Xt+CHRS(0>> 

855 BI*XAND3:BI*BI-1:BI*BIAND3:HP«(XAND252)ORBI 

860 PRlNTlll5?*M-W*CHRt (0> CHRt (JMHIHRt^lf CHR* (HP) :CLOSE15:FORTD«1TO3000NEXT 
865 RUN40 

900 PRINT *< SC HNSERT DISKETTE TO BE FORMATTED* : GOSUB200B 
905 INPUT*<CD>DISKETTE NAME * * XI:NMt*Xt:GOSUB1100 
910 INPUT"<CD>DISKETTE ID*iXt:IDt*Xt:GOSUB1100-GOSUB2000 
915 PRINT*<SCIFORMAT ENABLED PLEASE WAIT* 

920 OP£N15,8.15:PRINT*I15,"N0:*NMtiCHRt(44);IDt:INPUTK15,AS.Bt,Ct.D* 

930 PRINT *{CD > * At,Bt.Ct.Dt:CLOSE15:FORTD*1TO3000:NEXT:RUN40 

1000 IFXS«*X"THENRUN40 

1005 F0RI*1T04:Dt <I> *MIDt(Xt,1,1):NEXT 

1010 F0RI*lT04:D(I)»UAL(Dt(lM 

1020 IFDS(I)«*A*THEND(I>*10 

1025 IFDt(I)**B*THEND(I)*11 

1030 IFDt(I)**C*THEND(I)*12 

1035 IFDt<I) s *D*THEND(I)*13 

1040 IFDt(I)*“E"THEND<I)*14 

1045 IFDt(I)**F*THENO(I>*15 

1060 D(1)*D(1>*4096:D(2)»D(2)*256:D(3)«D(3)*16:X*D(1)+D(2)+D(3)+D(4) 

1065 RETURN 

1100 IFXtO*X*THENRETURN 
1105 RUN40 

2000 PRINT*{CD>CHECK DISK THEN PRESS F7* 

2010 GETF7t:IFF7tO*{F7)*THEN2010 
O0O0 R£TU^N 

2030 PRINT*<YL><CD>BUFF ADDRESS TOO LOW(WH>*:FORTD*1TO2000:NEXT:PRINT*<SC>*:GOTO120:RETURN 
2040 PRINT *<YLM CD >BUFF ADDRESS TOO HIGH<WH>* :FORTD*1TO2000: NEXT-.PRINT* (SC>* --GOTO120: RETURN 
3000 F0RRP*1T011:READERS(RP>:NEXT _ 

3010 DATA*ALL 0K*,*N0 HEADER FOUND*»“NO SYNC FOUND*.'DATA BLOCK NOT FOUND* 

3020 DATA'CHECKSUM ERROR IN DATA*.*BYTE DECODING ERROR*.“WRITE VERIFY ERROR" 

3030 BATA'WRITE PROTECT ON*.'CHECKSUM ERROR IN HEADER".“LONG DATA BLOCK- 
3040 DATA*DI5K ID MISMATCH- 
3050 RESTORE:RETURN 
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♦NOTE: ZMACH can be used to recover any program after a 
crash and reset! Use following procedure: 

1. First load "ZMACH",8,1 

2. Type NEW [RETURN]. 

3. Load your program, type SYS49152 [RETURN] 

4. To restore your program after a reset or new, type 
SYS49184 [RETURN] 
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*** CHAPTER SEVEN *** 


CARTRIDGES 


This chapter is primarily a reference aid for 
building and using the ROMULATOR system. We will 
summarize the major points of cartridge duplication 
theory, but for a complete understanding, you will need 
to cover the material under the Cartridge headings in 
chapters 2, 3, and 4. 

As discussed in the earlier sections, the autorun 
feature of a cartridge makes it impossible to "get 
into" via normal methods such as STOP RESTORE and so 
on. The autorun is a part of the power-up job of the 
C64, so defeating it requires the cartridge to be 
"invisible" during power-up. Once the system is running 
under user control, you are then able to get into the 
cartridge for saving, disassembling and whatever else 
you may want to do. This is one of the main tasks of 
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the Romulator card. 

The next area of concern with cartridges is the 
way they reconfigure memory. Two of the lines to the 
cartridge (GAME and EXROM) control the way the C64 
organizes its internal RAM and ROM. There are four 
combinations which are shown in table 3.3. Once again, 
the Romulator circuit card overrides the cartridge and 
allows you to change the configuration. In this manner 
you can easily find out the normal configuration used 
by the cartridge. 

The fact that a cartridge is a ROM based program 
affords it another kind of protection. That is that the 
program can "write" data to the ROM locations, but this 
will not change the data actually stored there. In 
other words, the program cannot "erase itself"! If you 
run a ROM based program in RAM, a write enable line is 
necessary. This enable can be turned OFF which in 
effect protects the RAM from write-over. It then works 
just like a ROM with the exception that it will lose 
data when power is removed. The Romulator card has a 
write enable switch as well as a socket into which you 
plug an 8K or 16K Vic-20 RAM expander card. These were 
chosen because they are readily available at a 
reasonable price. Many C64 owners started with a Vic- 
20 and still have expander cards. In the case of 16K 
duplication the card will also need block switching. 
(The Romulator Switch Card is illustrated in this 
chapter and is available for those with Commodore 
cartridges without the switching capability) If your 
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RAM already has the ability to switch either half of 
the 16K into block one or two or OFF, you will not need 
a switchcard. (Note that this reference is to the Vic- 
20 block one and two, not C64 RAM area) 

It is possible to run some cartridge programs in 
the computer RAM. The general procedure is to find the 
normal location of the ROM program, load or transfer 
the contents of the ROM to its equivalent location in 
RAM. You must then determine the normal entry point of 
the program (sometimes the first two bytes of the 
program) and SYS to that location. You may wish to 
experiment with this procedure but we have not found it 
predictable enough to write about. The Romulator system 
on the other hand, has proven effective for every 
cartridge we have thus far encountered. 

ROMULATOR HARDWARE 
SYSTEM DESCRIPTION 


The Romulator system consists of a special circuit 
card and a program which are used together to transfer 
the contents of ROM based cartridges to tape or disk. 
We will refer to the copies as "cartridge tapes" or 
"cartridge disks". To run the cartridge tapes or disks 
you must supply a 8K or 16K Vic-20 RAM expander (for 
16K cartridges you must have 16K RAM with block 
switching). The Romulator with RAM plugged in need not 
be removed from the expansion port. It will not affect 
normal computer operations. Cartridge disks/tapes can 
be loaded and run at will. In addition, a cartridge 
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program can be "switched" out and in without reloading, 
as long as power is not interrupted. Another handy 
feature when using a 16K RAM is that two 8K cartridge 
disks/tapes can be resident at one time allowing you to 
simply switch between them. An edge connector at the 
back allows cartridges to also be plugged in and 
operated without removing Romulator. 

THEORY OF OPERATION 


Figure 7.1 shows the Romulator schematic. Note 
that the data and address bus (A0-A12) pass 
uninterrupted to both the cartridge and RAM slots on 
the Romulator card. The GAME and EXROM lines however 
are intercepted by the card so that you have complete 
manual control of the system configuration. A Reset 
button is also provided for cold starts. Write enable 
is on board in case your RAM does not provide it. 

The key to the system is the 74138 decoder and 
block switching system. We have chosen the $4000 block 
to serve as RAM buffer for cartridges since it allows 
other user programs below? and 16K worth of transfered 
ROM above. The Romulator program will transfer the 
contents of cartridges to $4000, and also saves them 
from there. A jumper rail is provided if you wish to 
modify this for your own reasons. 

The ROML and ROMH lines are normally used by the 
computer to select the cartridge according to the 
location forced by EXROM and GAME lines. With these 
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lines open and GAME and EXROM open, the computer cannot 
"see" the cartridge. To avoid conflicts with the basic 
ROM (ROMH), we will always connect the ROM to be copied 
to the ROML line. The T switch makes this transfer if 
the cartridge is normally selected by ROMH. By first 
turning on EXROM, reseting, then switching the 
cartridge into ROML, any ROM can be forced to appear at 
$8000 without running! The RAM need not be active at 
this time although it does not affect the operation if 
it is. The Romulator program then performs the transfer 
to $4000 and the Save. The process is repeated for 16K 
cartridges. For 16Ks, you will first save the ROML half 
then the ROMH half using the T switch. 

The loading process requires the RAM to be 
situated at $4000 with the R switch, write Enable 
should be ON. A normal load is done, then if 16K the 
load is repeated with the other half of the RAM and 
other half of the cartridge disk. The RAM is then 
switched into the location used by that cartridge using 
the CA and AA switch or the C8 and A8 switches. ( 
Switches ending in 'A for ROMH cartridges and '8 for 
ROMLs). Then by switching OFF write enable and setting 
GAME and EXROM, the RESET will start the cartridge 
program! 

Though the theory may seem a little confusing, the 
step by step procedure given later will make the 
process quite simple. 

ASSEMBLY 
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We do not recommend that you try to build your own 
circuits unless you have had considerable experience 
doing so. The damage possible to your computer system 
through improperly built circuits would far outweigh 
the slight cost advantage you may obtain. 

If you have the experience necessary you will find 
the layout straight-forward. The ROM socket is soldered 
directly to the pads at the end of the board. Note the 
correct orientation of the IC and switches. The RAM 
socket is mounted near the center of the board. The PC 
board is double sided, note the Top and Bottom side 
layouts. All through-hole feeds should be soldered top 
and bottom side or plated through. Be careful not to 
make solder bridges between adjacent traces on the PC 
board. See Appendix G for assembled unit availability. 

16K RAM SWITCH MODIFICATION 


If you own a Commodore 16K RAM and wish to be able 
to do 16K cartridges, you will need a RAM switch card. 
No changes are required if you are only interested in 
doing 8K cartridges and will be using an 8K expander 
addressed for block one. (Vic-20 block) Figures 7.3 and 
7.4 show the schematic and PC layout for this. With the 
card installed in your RAM, you will have the ability 
to switch either 8K half of the 16K into block one or 
two. Figure 7.5 shows the positioning of the card in 
the Commodore RAM case. If you have another brand of 
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SWITCH CARD OR ENT ATION 



RAM CARTRIDGE SHOWN FROM BOTTOM 





RAM, you will have to have some other switching system. 


16K RAM SWITCH INSTALLATION 
FOR COMMODORE RAMS 

1. Disassemble 16K case. (1 screw, 4 snaps) 

2. Orient RAM SWITCH as shown in figure 7.5. 

3. Use small piece of tape to hold board as shown in 
figure 7.8. You should be looking at the soldered side 
of the RAM and the foil side of the SWITCH CARD. The 
large hole in the SWITCH CARD should be aligned with 
the screw hole of the RAM. 

4. Pretin SWITCH CARD numbered pads with SMALL puddle of 
solder. 

5. Tack solder kynar wire from numbered pads on SWITCH 

CARD to like numbered pads on RAM. (1 to 1, 2 to 2, 3 

to 3.. . ) 

6. Make certain jumpers on RAM at location indicated are 
cut. If switch is in this position, make sure all 
switches are OFF. (Some have 4 switches for half and a 
jumper for other half. All must be OPEN! 

7. Double check all connections. Make certain that wire 
insulation is close enough to pad so inter-pad shorts 
cannot occur. 


YOUR NEW BLOCK SELECT SWITCHES ARE: 

N ^ N ^ 



|5nd 8K HALF J |lrst SK HALF} 

185 



FIGURE 7.6 

SWITCHCARD TO RAM WIRING 
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ROMULATOR PROCEDURE 8K 


The following instructions give the step by step 
procedure for using the Romulator system. We will refer 
all operations to disk. Just replace word "disk" with 
"tape" if you are using tape. Tape requires 3ROMULATOR 
program, disk uses 2ROMULATOR or, abbreviated, 2R*. 
Note that the Romulator circuit card with RAM may be 
left "permanently" plugged into computer. If you are 
not otherwise using expansion port it will not affect 
normal operation. All steps below assume it is already 
plugged in. 

SAVING 8K CARTRIDGES 

1. With power OFF, plug cartridge to copy into the 
Romulator cartridge socket. All Romulator switches 
should be OFF. 

2. Turn ON computer. Using table 7.1, try each combination 

of GAME, EXROM, A8, and AA. (follow each by pressing 

RESET). One of the combinations should result in 
RUNNING of the cartridge. If not, it may be 16K, go to 
16K save procedure. WRITE DOWN the combination used 
which made it RUN. (Such as A8-C8-GM-EX) 

3. Turn OFF all switches. Turn ON EXROM and press RESET. 
30719 Bytes Free message should appear. 

4. Using information obtained in above steps, now turn ON 
switch A8 if you wrote down A8. Use switch T if you 
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o 

o 

wrote down AA. _ 

C ! 

5. LOAD appropriate Romulator program then perform 

SYS3291. Romulator title notice should appear. Follow O 

prompts. NAME should be less than 16 characters ...Do ^ 

c> 

NOT use quotes. 

o 

6. For additional backups repeat step 5 from SYS3291 only! 

C 

7. NOTE: A copy can be made from a copy by using editor ^ 

assembler and loading cartridge disk then Saving $4000 ^ 

to $6000. . You may find this easier than using the Q , 

ROMULATOR procedure to make backups of the disk at a C 

later date. ^ 

c 

LOADING-RUNNING CARTRIDGE DISKS/TAPES C 

c 

c 

1. Switch all Romulator Switches OFF. Turn ON switch R, C 

. . c 

and WRITE ENABLE. Switch RAM switch so RAM is m Block _ 

c 

one. (When loading second half of 16K, use second half £ , 

of RAM in block one...First half all OFF.) C 

2. Press RESET. 38911 message should appear. LOAD C 

cartridge disk using "prg name",8,1 or tape with "prg ^ 

l 

name",1,1. £ 

3. When done loading. Switch WRITE ENABLE OFF. (For 16K ( 

switch first half of RAM out of block one and switch £ 

second half in then repeat step 2. When done, Write ^ 

Enable OFF, first half of RAM into block 1 second half ^ 

into block 2 , also turn R OFF! ) £ 

4. Turn ON the switches you wrote down from SAVE procedure C 

o 

table 7.1. This information should be kept with the ^ 

program. One convenient way is to include as part of ^ , 

O 
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program name 


5. Press RESET button and program should RUN! 

—TABLE 7.1 — 



WRITE DOWN 

GM 

1LO 1 

EX A8 

AA 

ON 

OFF 

ON 

OFF 

A8-C8-GM 

OFF 

ON 

ON 

OFF 

A8-C8-EX 

ON 

ON 

ON 

OFF 

A8-C8-GM-EX 

ON 

OFF 

OFF 

ON 

AA-CA-GM 

OFF 

ON 

OFF 

ON 

AA-CA-EX 

ON 

ON 

OFF 

ON 

AA-CA-GM-EX 




16K SAVE PROCEDURE 

The main difference between 16K and 8K procedure is 
that the 16K has to be handled in halves. You should 
think of your RAM as having a First half and a Second 
half. The ROM will be saved one half at a time. Each 
half is saved identically except that the T switch is 
used to place the second half of the ROM into position 
so Romulator can see and save it. These steps assume 
that you already know the cartridge is a 16K as 
discovered by the first few steps of the 8K procedure. 

1. Use the first three patterns of TEST on table 7.1 to 
determine the RUN configuration. However, AA & A8 
should both be on for each 16K test. 

2. When you discover the correct pattern for RUNNING write 
down the configuration indicated. 

3. Turn OFF all switches. Turn ON EXROM and press RESET. 
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30719 message should appear. 

4. LOAD the appropriate version of Romulator (tape or 
disk). SYS3291 , Romulator title should appear. SWITCH 
A8 ON! 

5. Follow prompts. For NAME use a 1 followed by program 
name to indicate lrst half. Name must be less than 16 
characters, do NOT use quotes. 

6. When done turn OFF all switches and turn ON EXROM. 
Press RESET, 30719 message should appear. Turn ON 
T. 

7. Type SYS3291. (You do not need to reload it as long as 
power wasn't interupted). 

8. Again follow prompts. Use a 2 in front of name to 
indicate second half of program. 

9. This completes 16K SAVE procedure. You now have the 
program in two halves called "lname" and "2name". The 
LOAD RUN procedure covers the method of running both 8K 
and 16K cartridge disks/tapes. 

- PROGRAMS - 


Following are the listings in assembly code 
(machine code is used for data tables). Note that there 
is a data table starting at $0A00 and extending to the 
beginning of the program area, $0BD6. We recommend the 
use of an editor assembler Memory command to type in 
the table and the Assemble command for the program. 
2R0MULAT0R is for disk saves and 3R0MULAT0R is for 
tapes. PSIDAC supplies a complete disk of the programs 
in this book if you do not wish to type these by hand. 
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3R0M 

DATA TABLE 



0R00 

0B 

0B 

11 

F3 

11 

23 

03 

0F 

0R08 

01 

01 

00 

00 

80 

00 

40 

20 

0R10 

00 

60 

00 

00 

00 

00 

00 

00 

0R18 

00 

00 

00 

00 

00 

00 

00 

00 

0R20 

00 

00 

00 

00 

00 

00 

93 

05 

0R28 

20 

20 

20 

20 

20 

20 

84 

84 

0R30 

R4 

R4 

R4 

84 

84 

84 

84 

84 

0R38 

R4 

R4 

R4 

84 

84 

84 

84 

84 

0R40 

R4 

84 

84 

84 

84 

84 

84 

84 

0R48 

R4 

R4 

20 

20 

0D 

20 

20 

20 

0R50 

20 

20 

20 

74 

9F 

33 

52 

4F 

0858 

411 

55 

4C 

41 

54 

4F 

52 

20 

0R60 

9E 

23 

43 

29 

IE 

50 

53 

49 

0863 

44 

41 

43 

20 

33 

34 

2B 

56 

0R70 

4E 

05 

87 

20 

0B 

20 

20 

20 

0R78 

20 

20 

20 

83 

83 

83 

83 

83 

0R80 

R3 

R3 

R3 

83 

83 

83 

83 

83 

0R33 

R3 

R3 

R3 

83 

83 

83 

83 

83 

0R90 

R3 

R3 

83 

83 

83 

83 

83 

20 

0R98 

20 

0D 

20 

20 

20 

20 

84 

84 

0RR0 

R4 

R4 

84 

84 

84 

84 

84 

84 

0RR3 

R4 

R4 

84 

84 

84 

84 

84 

84 

0RB0 

R4 

84 

84 

84 

84 

84 

84 

84 

0RB3 

R4 

84 

84 

84 

84 

84 

20 

0D 

0RC0 

04 

20 

20 

20 

20 

2R 

20 

28 

0RC8 

20 

43 

41 

52 

54 

52 

49 

44 

0RD0 

47 

45 

20 

42 

41 

43 

4B 

55 

0RB3 

50 

20 

50 

52 

4F 

47 

52 

41 

0RE0 

4D 

20 

28 

20 

28 

20 

20 

0D 

0RE3 

20 

20 

20 

20 

83 

83 

83 

83 

0RF0 

R3 

83 

R3 

83 

83 

83 

83 

83 

0RF8 

83 

83 

83 

83 

83 

83 

83 

83 

0B00 

R3 

83 

83 

83 

83 

83 

83 

83 

0B0S 

83 

83 

83 

83 

20 

20 

20 

11 

0B10 

0D 

20 

20 

20 

20 

20 

23 

31 

0B18 

29 

20 

52 

45 

41 

44 

59 

20 

0520 

54 

41 

50 

45 

20 

55 

4E 

49 

0B28 

54 

20 

46 

4F 

52 

20 

53 

41 

0B30 

56 

45 

20 

20 

20 

11 

0D 

20 

0B38 

20 

20 

20 

20 

28 

32 

29 

20 

0B40 

50 

52 

45 

53 

53 

20 

46 

37 

0B48 

20 

20 

11 

0D 

04 

04 

20 

20 

0B50 

20 

20 

20 

23 

33 

29 

20 

49 

0B58 

4E 

50 

55 

54 

20 

50 

52 

4F 

0B60 

47 

52 

41 

4D 

20 

4E 

41 

4B 

0B68 

45 

20 

20 

11 

0D 

20 

20 

20 

9B70 

20 

20 

23 

34 

29 

20 

04 

04 

0B73 

04. 

04 

04 

11 

20 

20 

20 

20 

0B80 

20 

23 

35 

29 

20 

4F 

50 

45 

0B83 

52 

41 

54 

49 

4F 

4E 

20 

43 

0B90 

4F 

4D 

50 

4C 

45 

54 

45 

20 

0B93 

52 

45 

4D 

4F 

56' 

45 

20 

20 

0BR0 

0D 

20 

20 

20 

20 

20 

20 

20 

0BR3 

20 

20 

54 

41 

50 

45 

20 

46 

0BB0 

52 

4F 

4D 

20 

55 

4E 

49 

54 

0BB8 

20 

11 

20 

20 

0D 

20 

20 

20 

0BC0 

20 

20 

28 

36 

29 

20 

50 

52 

0BC8 

45 

53 

53 

20 

46 

37 

20 

0D 

0BB0 

20 

20 

04 

04 

04 

04 

8D 

0B 
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0BD 6 

RD 

0E 

0R 

LDR 

$0R0B 

0C4B 

D0 

F3 


BNE 

$0C40 


0BD9 

85 

FB 


STR 

$FB 

0C4D 

60 



RTS 



0BBB 

RD 

0C 

0R 

LDR 

$0R0C 

0C4E 

00 



BRK 



0BDE 

85 

FC 


STR 

$FC 

0C4F 

00 



BRK 



0BE0 

RD 

0D 

0fl 

LDR 

$0R0D 

0C50 

00 



BRK 



0BE3 

85 

FD 


STR 

$FD 

0C51 

R2 

00 


LDX 

#$00 


0BE5 

RD 

0E 

0fl 

LDR 

$0R0E 

0C53 

BD 

7B 

0B 

LDR 

$0B7B. 

, x 

0BE8 

85 

FE 


STR 

$FE 

0C56 

C9 

04 


CMP 

#$04 


0BER 

RD 

30 

0fl 

LDR 

S0R00 

0C58 

F0 

06 


BEQ 

$0C60 


0BED 

8D 

20 

D0 

STR 

$D020 

0C5R 

2© 

D2 

FF 

JSR 

$FFD2 


0BF0 

RD 

01 

0fl 

LDR 

$0R01 

0C5D 

E8 



I NX 



0BF3 

3D 

21 

D0 

STR 

$D021 

0C5E 

D0 

F3 


BNE 

$0C53 


0BF6 

RD 

07 

0fi 

LDR 

$0R07 

0C60 

60 



RTS 



0BF9 

8D 

18 

D4 

STR $D413 

0C61 

00 



BRK 



0BFC 

RD 

02 

0fl 

LDR 

$0R02 

0C62 

00 



BRK 



0BFF 

3D 

05 

D4 

STR 

$D405 

0C63 

00 



BRK 



0C02 

RD 

03 

0R 

LDR 

$0R03 

0C64 

20 

E4 

FF 

JSR 

$FFE4 


0C05 

3D 

36 

D4 

STR 

$D406 

0C67 

C9 

83 


CMP 

#$38 


0C08 

RD 

06 

0fi 

LDR 

$0R06 

0C69 

D0 

F9 


BNE 

$0C64 


0C0B 

8D 

00 

D4 

STR 

$D400 

0C6B 

60 



RTS 



0C0E 

RD 

05 

0fl 

LDR 

$0R05 

0C6C 

00 



BRK 



0C11 

3D 

01 

D4 

STR' 

$D401 

0C6D 

00 



BRK 



0C14 

60 



RTS 


0C6E 

RE 

05 

0R 

LDX 

$0R05 


0C15 

00 



BRK 


0C71 

3E 

04 

D4 

STX 

$D404 


0C16 

00 



BRK 


0C74 

Cfi 



DEX 



0C17 

00 



BRK 


0C75 

8E 

04 

D4 

STX 

$D404 


0C18 

R2 

00 


LDX 

#$00 

0C73 

60 



RTS 



0C1R 

BD 

26 

0fl 

LDR 

$0R26,X 

0C79 

R2 

00 


LDX 

#$00 


0C1D 

C9 

04 


CMP 

#$04 

0C7B 

R0 

00 


LDV 

#$00 


0C1F 

F0 

06 


BEQ 

$0C27 

0C7D 

B1 

FB 


LDR 

<$FB>, 

V 

0C21 

20 

D2 

FF 

JSR 

$FFD2 

0C7F 

91 

FD 


STR 

C$FD>, 

V 

0C24 

E8 



I NX 


0C31 

C8 



INV 



0C2S 

D0 

F3 


BNE 

$0C1R 

0C32 

C0 

00 


CPV 

#$00 


0C27 

60 



RTS 


0C34 

D0 

F7 


BNE 

$0C7D 


0C28 

00 



BRK 


0C36 

E6 

FC 


INC 

$FC 


0C29 

00 



BRK 


0C83 

E.6 

FE 


INC 

$FE 


0C2R 

00 



BRK 


0C8R 

E8 



I NX 



0C2B 

R2 

00 


LDX 

#$00 

0C3B 

EC 

0F 

0fl 

CPX 

$0R0F 


0C2D 

BD 

Cl 

0fl 

LDR 

$0fiCl,X 

0C8E 

D0 

EB 


BNE 

$0C7B 


0C?0 

C3 

04 


CMP 

#$04 

0C90 

60 



RTS 



0C32 

F0 

06 


BEQ 

$0C3fl 

0C91 

00 



BRK 



0C34 

20 

D2 

FF 

JSR 

$FFD2 

0C92 

30 



BRK 



0C37 

E3 



I NX 


0C93 

00 



BRK 



0C33 

D0 

F3 


BNE 

$0C2D 

0C94 

R0 

00 


LDV 

#$80 


0C3R 

60 



RTS 


0C96 

20 

CF 

FF 

JSR 

$FFCF 


0C3B 

00 



BRK 


0C99 

99 

16 

0fl 

STR 

$0R16,V 

0C3C 

30 



BRK 


0C9C 

C3 



INV 



0C3D 

00 



BRK 


0C9D 

C9 

0D 


CMP 

#$0D 


0C3E 

R2 

00 


LDX 

#$00 

0C9F 

D0 

F5 


BNE 

$0C96 


0C40 

BD 

4E 

0B 

LDR 

$0B4E,X 

0CR1 

20 

6E 

0C 

JSR 

$0C6E 


0C43 

C9 

84 


CMP 

#$04 

0CR4 

3C 

0R 

0fl 

STV 

$0R0R 


0C45 

F0 

06 


BEQ 

$0C4D 

0CR7 

RD 

03 

0R 

LDR 

$0R08 


0C47 

20 

D2 

FF 

JSR 

$FFD2 

0CRR 

RE 

09 

0fl 

LDX 

$0R09 


0C4R 

E3 



I NX 


0CRD 

R0 

FF 


LDV 

#$FF 
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3R0MULAT0R _ 

- 

0CflF 

20 

BR 

FF 

JSR 

$FFBfi 

0CE2 

RB 

0R 

0R 

LBR 

$0R@R 

0CB5 

fl2 

16 


LBX 

#$16 

0CB7 

fl0 

0R 


LBV 

#$0R 

0CB9 

20 

BB 

FF 

JSR 

$FFBB 

0CBC 

flB 

0B 

0R 

LBR 

$0R0B 

0CBF 

35 

FB 


STR 

$FB 

0CC1 

RB 

0E 

0fl 

LBR 

$0R0E 

0CC4 

35 

FE 


STR 

$FE 

0CC6 

R9 

0B 


LBR 

#$0B 

0CCS 

20 

B2 

FF 

JSR 

$FFB2 

0CCB 

R9 

FB 


LBR 

#$FB 

0CCD 

RE 

10 

0fl 

LBX 

$0R10 

0CB0 

RC 

11 

0fl 

LBV 

$0R11 

0CB3 

20 

B8 

FF 

JSR 

$FFB3 

0CB6 

60 



RTS 


0CB7 

00 



BRK 


0CB8 

00 



BRK 


0CD9 

00 



BRK 


0CBR 

00 



BRK 


0CIIB 

20 

B6 

0B 

JSR 

$0BB6 

0CDE 

20 

13 

0C 

JSR 

$0C18 

0CE1 

20 

2B 

0C 

JSR 

$0C2B 

0CE4 

20 

64 

0C 

JSR 

$0C64 

0CE7 

20 

6E 

0C 

JSR 

$0C6E 

0CEfl 

20 

79 

0C 

JSR 

$0C79 

0CEB 

20 

3E 

0C 

JSR 

$0C3E 

0CF0 

20 

94 

0C 

JSR 

$0C94 

0CF3 

20 

51 

0C 

JSR 

$0C51 

0CF6 

20 

6E 

0C 

JSR 

$0C6E 

0CF9 

20 

64 

0C 

JSR 

$0C64 

0CFC 

20 

6E 

0C 

JSR 

$0C6E 

0CFF 

60 



RTS 
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2R0M. DATA TABLE 


0000 

0B 

0B 

11 

F8 

11 

23 

03 

0F 

0ft03 

08 

08 

00 

00 

30 

00 

40 

20 

00 10 

00 

60 

00 

00 

00 

00 

00 

00 

0ft 13 

00 

00 

00 

00 

00 

00 

80 

80 

0ft20 

00 

00 

00 

00 

00 

00 

93 

05 

0R23 

20 

20 

20 

20 

20 

20 

04 

04 

0ft30 

04 

04 

04 

04 

04 

R4 

04 

04 

0ft33 

04 

04 

04 

04 

04 

04 

04 

04 

0040 

04 

04 

04 

04 

04 

04 

04 

04 

0R43 

04 

04 

20 

20 

0D 

20 

20 

20 

0fl50 

20 

20 

20 

74 

9F 

32 

52 

4F 

0R53 

4D 

55 

4C 

41 

54 

4F 

52 

20 

0060 

9E 

23 

43 

29 

IE 

50 

53 

49 

0063 

44 

41 

43 

20 

38 

34 

2D 

56 

0070 

4E 

05 

07 

20 

0D 

20 

20 

20 

0073 

20 

20 

20 

03 

03 

03 

03 

03 

0080 

03 

03 

03 

03 

03 

03 

03 

03 

0088 

03 

03 

03 

03 

03 

03 

03 

03 

0090 

03 

03 

03 

03 

03 

03 

03 

20 

0093 

20 

0D 

20 

20 

20 

20 

04 

04 

0000 

04 

04 

04 

04 

04 

04 

04 

04 

0008 

04 

04 

04 

04 

04 

04 

04 

04 

0OB0 

04 

04 

04 

04 

04 

04 

04 

04 

0OB8 

04 

04 

04 

04 

04 

04 

20 

0D 

0OC0 

04 

20 

20 

20 

20 

20 

20 

20 

0OCS 

20 

43 

41 

52 

54 

52 

49 

44 

0RD0 

47 

45 

20 

42 

41 

43 

4B 

55 

0OB8 

50 

20 

50 

52 

4F 

47 

52 

41 

QOE0 

4D 

20 

20 

20 

20 

20 

20 

0D 

0OE3 

20 

20 

20 

20 

03 

03 

03 

03 

0OF0 

03 

03 

03 

03 

03 

03 

03 

03 

0OF8 

03 

03 

03 

03 

03 

03 

03 

03 

0B00 

03 

03 

03 

03 

03 

03 

03 

03 

0B08 

03 

03 

03 

03 

20 

20 

20 

11 

0B10 

0D 

20 

20 

20 

20 

20 

23 

31 

0B13 

29 

20 

49 

4E 

53 

45 

52 

54 

0B20 

20 

43 

4F 

50 

59 

20 

44 

49 

0B28 

53 

4B 

20 

49 

4E 

20 

44 

52 

0B30 

49 

56 

45 

20 

20 

11 

0D 

20 

0B38 

20 

20 

20 

20 

23 

32 

29 

20 

0B40 

50 

52 

45 

53 

53 

20 

46 

37 

3B48 

20 

20 

11 

0D 

04 

94 

20 

20 

0B50 

20 

20 

20 

28 

33 

29 

20 

49 

0B58 

4E 

50 

55 

54 

20 

Rtf 

52 

4F 

0B60 

47 

52 

41 

4H 

20 

4E 

41 

4D 

0B63 

45 

20 

20 

11 

0D 

20 

20 

20 

0B70 

20 

20 

28 

34 

23 

20 

04 

04 

0B78 

04 

04 

04 

11 

20 

20 

20 

20 

0B30 

20 

23 

35 

29 

20 

4F 

50 

45 

0B38 

52 

41 

54 

49 

4F 

4E 

20 

43 

0B90 

4F 

4D 

50 

4C 

45 

54 

45 

20 

0B98 

52 

45 

4B 

4F 

56 

45 

20 

20 

0BO0 

0D 

20 

20 

20 

20 

20 

20 

20 

0BO8 

20 

20 

44 

49 

53 

4B 

20 

46 

0BB0 

52 

4F 

4D 

20 

44 

52 

49 

56 

©BBS 

45 

11 

20 

20 

0D 

20 

20 

20 

0BC0 

20 

20 

28 

36 

29 

20 

50 

52 

0BC3 

45 

53 

53 

20 

46 

o C 

20 

0D 

0BB8 

11 

11 

04 

04 
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04 

04 

0D 

0B 


n n n n n a ^ n nno/^nnoon n n n n r^ ^ ^ 


c 

c 

( 

( 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

( 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

( 

c 

c 

c 

c 

c 

c 


2R0MULAT0R - 


0BB 6 

RB 

0B 

0fl 

LBfi 

$0R0B 

0C4B 

B0 

F3 


BNE 

$0C40 

0BB9 

85 

FB 


STR 

$FB 

0C4B 

60 



RTS 


0BBB 

RB 

0C 

0fi 

LBR 

$0R0C 

0C4E 

00 



BRK 


0BDE 

85 

FC 


STR 

$FC 

0C4F 

00 



BRK 


0BE0 

RB 

0B 

0fl 

LBR 

$0R0B 

0C50 

00 



BRK 


0BE3 

85 

FB 


STR 

$FB 

0C51 

R2 

00 


LBX 

#$00 

0BE5 

RB 

0E 

0R 

LBR 

$0R0E 

0C53 

BB 

7B 

0B 

LBR 

$0B7B,X 

0BE8 

85 

FE 


STR 

$FE 

0C56 

C9 

04 


CMP 

#$04 

0BER 

RB 

00 

0R 

LBR 

$0R00 

0C58 

F0 

06 


BEQ 

$0C60 

0BEB 

3B 

20 

B0 

STR 

$B028 

0C5R 

20 

B2 

FF 

JSR 

$FFB2 

0BF0 

RB 

01 

0R 

LBR 

$0001 

0C5B 

E8 



I NX 


8BF3 

SB 

21 

B0 

SIR 

$B021 

0C5E 

B0 

F3 


BNE 

$0C53 

0BF6 

RB 

07 

0fl 

LBR 

$0R07 

0C60 

60 



RTS 


0BF9 

8B 

18 

B4 

STR 

$B413 

0C61 

00' 



BRK 


0BFC 

RB 

02 

0fi 

LBR 

$0R02 

0C62 

00 



BRK 


0EFF 

SB 

05 

B4 

STR 

$B405 

0C63 

00 



BRK 


0C02 

RB 

03 

0fi 

LBR 

$0R03 

0C64 

20 

E4 

FF 

JSR 

$FFE4 

0C05 

SB 

06 

B4 

STR 

$B406 

0C67 

C3 

83 


CMP 

#$38 

0C08 

RB 

06 

0R 

LBR 

$0R06 

0C69 

B0 

F9 


BNE 

$0C64 

0C0B 

SB 

00 

B4 

STR 

$B400 

0C6B 

60 



RTS 


8C0E 

RB 

05 

0fl 

LBR 

$0R05 

0C6C 

00 



BRK 


0C11 

8B 

01 

B4 

STR 

$B401 

0C6B 

00 



BRK 


0C14 

60 



RTS 


0C6E 

RE 

05 

0R 

LBX 

$0R05 

0C15 

00 



BRK 


0C71 

3E 

04 

B4 

STX 

$B404 

8C16 

00 



BRK 


0C74 

Cfl 



BEX 


0C17 

00 



BRK 


0C75 

8E 

04 

B4 

STX 

$B404 

0C18 

R2 

00 


LBX 

#$00 

0C78 

60 



RTS 


0C1R 

BB 

26 

0R 

LBR 

$0R26,X 

0C79 

R2 

00 


LBX 

#$00 

0C1D 

C9 

04 


CMP 

#$04 

0C7B 

R0 

00 


LBV 

#$00 

0C1F 

F0 

06 


BEQ 

$0C27 

0C7B 

B1 

FB 


LBR 

<$FB),V 

0C21 

20 

B2 

FF 

JSR 

$FFB2 

0C7F 

31 

FB 


STR 

<$FB),V 

0C24 

E3 



I NX 


0C31 

C3 



INV 


0C25 

B0 

F3 


BNE 

$0Clfl 

0C32 

C0 

00 


CP V 

#$00 

3C27 

60 



RTS 


0C34 

B0 

F7 


BNE 

$0C7B 

0C28 

00 



BRK 


0C36 

E6 

FC 


INC 

$FC 

0C23 

00 



BRK 


0C83 

E6 

FE 


INC 

$FE 

0C2R 

00 



BRK 


0C8R 

E3 



I NX 


0C2B 

R2 

00 


LBX 

#$08 

0C8B 

EC 

0F 

0R 

CPX 

$0R0F 

8C2B 

BB 

Cl 

0R 

LBR 

$0RC1 t X 

0C8E 

B0 

EB 


BNE 

$0C7B 

8C30 

C9 

04 


CMP 

#$04 

0C90 

60 



RTS 


0C32 

F0 

06 


BEQ 

$0C3R 

0C31 

00 



BRK 


0C34 

20 

B2 

FF 

JSR 

$FFB2 

0C92 

00 



BRK 


0C37 

E8 



I NX 


0C93 

00 



BRK 


8C38 

B0 

F3 


BNE 

$0C2B 

0C94 

R0 

00 


LBV 

#$00 

0C3R 

60 



RTS 


0C96 

20 

CF 

FF 

JSR 

$FFCF 

9C3B 

00 



BRK 


0C39 

99 

16 

0R 

STR 

$0R16,V 

0C3C 

00 



BRK 


0C3C 

CS 



INV 


0C3D 

00 



BRK 


0C3B 

C9 

0B 


CMP 

#$0B 

0C3E 

R2 

00 


LBX 

#$00 

0C9F 

B0 

F5 


BNE 

$0C36 

0C40 

BB 

4E 

SB 

LBR 

$0B4E,X 

0CR1 

3C 

0fl 

0fi 

STV 

$0R0R 

0C43 

C9 

04 


CMP 

#$04 

0CR4 

RB 

03 

0R 

LBR 

$0R03 

0C45 

F0 

06 


BEQ 

$0C4B 

0CR7 

RE 

09 

0R 

LBX 

$0R09 

0C47 

20 

B2 

FF 

JSR 

$FFB2 

0CRR 

R0 

FF 


LBV 

#$FF 

0C4R 

E8 



I NX 


0CRC 

20 

Bfl 

FF 

JSR 

$FFBR 
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0CRF 

RD 

0R 

0R 

LDR 

$0R0fl 

0CE2 

R2 

16 


LDX 

#$16 

0CB4 

R0 

0R 


LDV 

#$0fi 

0CB6 

20 

ED 

FF 

JSR 

$FFBD 

0CB9 

RD 

0D 

0R 

LDR 

$0R0D 

0CBC 

85 

FD 


STR 

$FD 

0CBE 

RD 

0E 

0fl 

LDR 

$0R0E 

0CC1 

85 

FE 


STR 

$FE 

0CC3 

R'3 

FD 


LDR 

#$FD 

0CC5 

RE 

10 

0R 

LDX 

$0R10 

0CC8 

RC 

11 

0R 

LDV 

$0R11 

0CCE 

20 

D8 

FF 

JSR 

$FFD8 

0CCE 

60 



RTS 


0CCF 

20 

6E 

0C 

JSR 

$0C6E 

0CD2 

20 

E4 

FF 

JSR 

$FFE4 

0CD5 

C9 

88 


CMP 

#$88 

0CII7 

D0 

F6 


BNE 

$0CCF 

0CD9 

60 



RTS 


0CDR 

00 



BRK 


0CDB 

20 

D6 

0B 

JSR 

$0BD6 

0CDE 

20 

18 

0C 

JSR 

$0C18 

0CE1 

20 

2B 

0C 

JSR 

$0C2B 

0CE4 

20 

64 

0C 

JSR 

$0C64 

0CE7 

20 

6E 

0C 

JSR 

$8C6E 

0CER 

20 

79 

0C 

JSR 

$0C79 

0CED 

20 

3E 

0C 

JSR 

$0C3E 

0CF0 

20 

94 

0C 

JSR 

$0C94 

0CF3 

20 

'51 

0C 

JSR 

$0C51 

0CF6 

20 

CF 

0C 

JSR 

$0CCF 

0CF3 

60 



RTS 
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APPENDIX A 

HEX-CHR$ S SCREEN CODES CHART 


CBM VALUE 

HEX CHR$ 

CHR DISPLAYED 
MODE-UPR MODE-LWR 

SCREEN CODE VALUE 
HEX SCRN DEC SCRN 

00 

0 





01 

1 





02 

2 





03 

3 





04 

4 





05 

5 

WHT 




06 

6 





07 

7 





08 

8 

SH/C OFF 




09 

9 

SH/C ON 




OA 

10 





OB 

11 





OC 

12 





OD 

13 

RET 




OE 

14 

LWR/CS ON 




OF 

15 





10 

16 





11 

17 

C/DN 




12 

18 

RVS/ON 




13 

19 

CLR/HM 




14 

20 

INST/DEL 




15 

21 





16 

22 





17 

23 





18 

24 





19 

25 





1 A 

26 





IB 

27 





1C 

28 

RED 




ID 

29 

C/RT 




IE 

30 

GRN 




IF 

31 

BLU 




20 

32 

SPACE 


20 

32 

21 

33 

; 

! 

21 

33 

22 

34 

tr 

M 

22 

34 

23 

35 

# 

# 

23 

35 

24 

36 

$ 

$ 

24 

36 

25 

37 

% 

% 

25 

37 

26 

38 

6 

s 

26 

38 

27 

39 

T 

» 

27 

39 

28 

40 

( 

( 

28 

40 

29 

41 

) 

) 

29 

41 

2A 

42 

«JU 

n* 


; 2A 

42 

2B 

43 

+ 

+ 

2B 

43 

2C 

44 

J 

1 

2C 

44 

2D 

45 

- 

- 

2D 

45 

2E 

46 

. 

. 

2E 

46 

2F 

47 

/ 

/ 

2F 

47 

30 

48 

0 

0 

30 

48 

31 

49 

1 

1 

31 

49 

32 

' r 

50 

2 

2 

32 

i 

1 j 

50 

y 
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A 

6F 

111 

S/0 

0 

j 

4F 

79 

70 

112 

S/P 

P 

50 

80 

71 

1 13 

S/Q 

Q 

51 

81 

72 

1 14 

S/R 

R 

52 

82 

73 

115 

S/S 

S 

53 

83 

74 

116 

S/T 

T 

54 

84 

75 

117 

S/U 

U 

55 

85 

76 

118 

S/V 

V 

56 

86 

77 

119 

S/W 

w 

57 

87 

78 

120 

S/X 

X 

58 

88 

79 

121 

S/Y 

Y 

59 

89 

7A 

122 

s/z 

z 

5A 

90 

7B 

123 

S/+ 


5B 

91 

7C 

124 

c/- 


5C 

92 

7D 

125 

s/- 


5D 

93 

7E 

126 

Pi 

Lg CKRBD 

5E 

94 

7F 

127 

c/* 

Diag Lns 

5F 

95 

80 

128 





81 

129 





82 

130 





83 

131 





84 

132 





85 

133 

FI 




86 

134 

F3 




87 

135 

F5 




88 

136 

F7 




89 

137 

F2 




8A 

138 

F4 




8B 

139 

F6 




8C 

140 

F8 




8D 

141 

SH/RET 




8E 

142 

UPR CS ON 

- 



8F 

143 





90 

144 

BLK 




91 

145 

CR/UP 




92 

146 

RVS ON 




93 

147 

CLR/HM 




94 

148 

INST/OEL 




95 

149 





96 

150 





97 

151 





98 

152 





99 

153 





9 A 

154 





9B 

155 





9C 

156 

PUR 




9D 

157 

CR/LFT 




9E 

158 

YEL 




9F 

159 

CYN 




AO 

160 

SPC 


60 

96 

A1 

161 

C/K 


61 

97 

A2 

162 

C/I 


62 

98 

A3 

163 

C/T 


63 

99 

A4 

164 

C/@ 


64 

100 

A5 

165 

C/G 


65 

101 

A6 

166 

C/+ 


66 

102 

A7 

167 

C/M 


67 

103 

A8 

168 

C/£ 


68 

104 

A9 

169 

S/£ . 

Diag Lns 

69 

105 

AA 

170 

C/N 


6A 

106 




1 ?? 




* 



AS 

171 

C/Q 


6B 

i 

107 

AC 

172 

C/0 


6C 

108. 

AO 

173 

c/z 


60 

109 

AE 

174 

c/s 


6E 

110 

AF 

175 

C/P 


6F 

111 

BO 

176 

C/A 


70 

112 

B1 

177 

C/E 


71 

113 

B2 

178 

C/R 


72 

114 

B3 

179 

c/w 


73 

115 

84 

180 

C/H 


74 

116 

65 

181 

C/J 


75 

117 

B6 

182 

C/L 


.76 

1 18 

B 7 

183 

C/Y 


77 

119 

BS ! 

184 

c/u 


78 

120 

B9 

185 

C/0 


79 

121 

BA 

186 

S/@ 

CK MARK 

7 A 

122 

BB 

187 

C/F 


7B j 

123 

BC 

188 

C/C 


7C 

124 

BO 

189 

C/X 


7D 

125 

BE 

190 

C/V 


7E 

126 

BF 

191 

C/B 


7F 

127 


NOTE: This table shows which characters will be displayed For 
any value oF CBM ASCII code. The two leFt columns give the 
values in hex and decimal (dec used For CHR$). The End and 
3rd columns show what will be displayed or what control mode 
aFFected, depending whether the computer is in the UPPER CASE 
MODE (column 2), or LOWER CASE MODE (column 3). The last two 
columns give the hex and decimal values used For the SCREEN 
DISPLAY COOES. The decimal value is used to POKE directly to 
screen locations, while the hex is used iF Storing to screen 
locations From a machine routine.. Note that S/ Followed by a 
letter means the SHIFTED letter which is the right hand 
graphic symbol on your key. A C/ means the COMMODORE KEY 
which produces the leFt Fiand graphic symbol on your keyboard. 


O 

O 

C> 

o 

o 

c 

o 

o 

o 

e 

o 

o 

o 

c 

C) 

o 

C) 

e 

o 

o 

o 

o 

o 

o 

o 

o 

C) 

o 

o 

o 

c 

o 

C) 

o 

c 

o 

o 

C) 

o 

o 

C) 

C) 
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APPENDIX B 

MONITOR USE WITH DISKPICKER 


Other monitors can be substituted for M0NIT0R$8000 
in Diskpicker by changing line 10 with alternate 
monitor 1 s name, and by changing the SYS to the 
monitor 1 s entry point in line 310 to that of the 
monitor you are using. Note that the alternate monitor 
should reside between $8000-$BFFF. 

All Diskpicker functions except #2 - Monitor Mode 
can be used without a Monitor. This gives you the 
ability to load and execute error utilities etc. The 
procedure for this is: 

1. Delete line 10. Change line 20 to read: IFA=0 THEN A=1 
: LOAD "ZMACH" ,8,1 

2. Press RUN/STOP - RESTORE then load "the desired 
utility program",8,1 then type NEW [RETURN] 

3. SYS49184 [RETURN] Then follow normal Diskpicker 
procedure section for error writing routine. 

HESM0N- cartridge can be used in lieu of 
M0NIT0R$8000. However, you will lose the ability to 
easily recover from lockup conditions which normally 
require reset and ZMACH restore features. Use the 
following changes and procedure: 

1. DELETE DISKPICKER LINE 10 and 20. Change line 35 to 
read: RUN40 

2. Change line 310 to read SYS 36466 

3. TO USE- Plug in HESM0N, turn computer ON, EXIT HESM0N 
with "XC" command. 

4. Load "DISKPICKER",8 and modify as above then RUN. 

5. Use RESTORE key to enter HESM0N instead of Menu item 

2! - To return from HESM0N, type "X" command then RUN. 

SUPERM0N64.VI -Is part of the Commodore 64 
Software Bonus Pack and seems to be readily available 
in the public domain. It can be used in place of 
Monitor$8000. Modify Diskpicker as fallows: 

1. Load "SUPERM0N64.V1",8 then RUN. Monitor prompt screen 
should appear. Use "X" command to EXIT to basic. Insert 
PSIPACK disk and LOAD "DISKPICKER",8 

2. Delete line 10. Change line 20 IF A=0 THEN 
A=1:LOAD"ZMACH" , 8 , 1 

3. Change line 310 to read: P0KE53281,3 : 

SYS(PEEKC433+256*PEEKC44)+127J 

4. RUN Diskpicker as per procedure sections. 

5. If you save the MODIFIED DISKPICKER, you need follow 
only step 1 in order to RUN Diskpicker with 
SUPERM0N!! 

6. If you are unable to locate SUPERM0N or the COMMODORE 
BONUS PACK, we will supply a copy of SUPERM0N for a 
handling fee of $5.00. 

If your M0NIT0R$8000 will not save itself, change 
hex locations $86EC through $86F7 to EA (These are 
NOPs). M0NIT0R$8000 can be easily saved using 
RELOCATE/LOADER procedures. 
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APPENDIX C 
AUTO-BOOTERS 


Following are two samples of autorun boaters. One 
is For booting machine routines and the other For 
basic. We have chosen 02A7-030C For the booter 
routines. Use an editor to assemble them in these 
locations. Remember that when you load the routine From 
the tape or disk it will call the program identiFied 
by the NAME bytes. To set the names and messages you 
wish to use, look up the HEX CBM ASCII value For the 
letter and control Functions in appendix A. 

The First part oF the routine sends a name to the 
screen to indicate that the booter is operating. The 
routine For machine has more available space For this 
message. The basic routine simply sends the name that 
you are calling with the loader. 

Next the standard Commodore Format For setting 
logical File, device number, name, and loading the RAM 
is used. Note that the device number is listed as $08 
Cdisk] tape is $01. 

Finally, in the machine booter, it jumps to the 
starting address oF the machine routine that was 
loaded. The basic routine sets necessary basic painters 
and restores 0302-030B vectors beFore it runs. 

It is a good idea to use the no-break Poke 808,255 
in your basic program. You should play around with some 
simple test routines beFore you commit the loader to 
service. 

To set the names and messages you wish to use, 
look up the HEX CBM ASCII value For the letter and 
control Functions in appendix A. 


O 

o 

o 

c> 

c 

c 

o 

Cl 

c 

o 

c 

o 

c 

c 

c 

c 

c 

c 

o 

Ci 

o 

G 

c> 

o 

c> 

e 

o 

o 

o 

o 

c 

o 

c 

c- 

c 

C) 

o 

o 

o 

o 

o 

o 
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APPENDIX C 


BASIC AUTOBOOTER 



02A7 

A2 

00 


LDX #$00 


02A9 

BD 

F6 

02 

LDA 

$02F6,X 


02 AC 

20 

D2 

FF 

JSR 

$FFD2 


02AF 

E8 



I NX 



02B0 

EO 

04 


CPX 

#$04 


02B2 

DO 

-F 5 


BNE 

$02A9 _ 


02B4 

A9 

10 


LDA #$10 


02B6 

A2 

08 


LDX #$08 


02B8 

AO 

01 


LDY #$01 


02BA 

20 

BA 

FF 

JSR 

$FFBA 


02BD 

A9 

04 


LDA 

#$04 


02BF 

A2 

F6 


LDX #$F6- 


02C1 

AO 

02 


LDY #$02 — 


02C3 

20 

BD 

FF 

JSR 

$FFBD 


02C6 

A9 

00 


LDA #$00 


02C8 

85 

9D 


STA 

$9D 


02CA 

20 

D5 

FF 

JSR 

$FFD5 


02CD 

86 

2D 


STX 

$2D 


02CF 

84 

2E 


STY 

$2E 


02D1 

A2 

OC 


LDX #$0C 


02D3 

BD 

E9 

02 

LDA 

$02E9,X 


02D6 

9D 

FF 

02 

STA 

$02FF,X 


02D9 

CA 



DEX 



02DA 

DO 

F7 


BNE 

$02D3 


02DC 

A9 

00 


LDA 

#$00 


02DE 

85 

7A 


STA 

$7A 


02E0 

A9 

08 


LDA 

#$08 


02E2 

85 

7B 


STA 

$7B 


02E4 

20 

60 

A6 

JSR 

$A660 


02E7 

4C 

AE 

A7 

JMP 

$A7AE 


02EA 

8B 






02EB 

E3 






02EC 

83 






02ED 

A4 

7C 





02EF 

A5 

1A 





02F1 

A7 






02F2 

E4 

A7 





02F4 

86 

AE 





/ GET NAME AT 
( 02 FG 
\ SEND TO 
J SCREEN 

] SET 

J LFS 

] NAME (AT 
j 02 F6) 

] LOAD 
j RAM 

RESET 

VEC. 

, EX. 

I BASIC 
PRG^ 


HEX DATA 


02EA 8B E3 

83 

A4 

7C 

A5 

1A 

A7 




02F2 E4 A7 

86 

AE 

54 

45 

53 

54 




02FA 02 86 

AE 

00 

00 

00 

36 

34 




0302 A7 02 

A7 

02 

A7 

02 

A7 

02 




030A A7 02 

00 

00 

00 

00 

4C 

48 




0 2 EA. C. $ ‘ 

&. ' 

8B 

E3 

83 

A4 

7C 

A5 

1A 

A7 

02F2D 1 ..TEST 

E4 

A7 

86 

AE 

54 

45 

53 

54 

02FA. 

.64 

02 

86 

AE 

00 

00 

00 

36 

34 

0302'.'. ' 

i 

A7 

02 

A7 

02 

A7 

02 

A7 

02 

030A*.... 

.LH 

A7 

02 

00 

00 

00 

00 

4C 

48 
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APPENDIX C cont 
MACHINE AUTOBOOTER 


• / 

02A7 

A2 

00 


LDX #$00 

• 9 

02A9 

BD 

DO 

02 

LDA 

$02D0,X 

• 9 

02AC 

20 

D2 

FF 

JSR 

$FFD2 

• 9 

02AF 

E8 



I NX 


• 9 

02B0 

EO 

IE 


CPX #$1E 

• 9 

02B2 

DO 

F5 


BNE 

$02A9 

• 9 

02B4 

A9 

10 


LDA 

#$10 

• 9 

02B6 

A2 

08 


LDX 

#$08 

• 9 

02B8 

AO 

01 


LDY #$01 • 

• 9 

02BA 

20 

BA 

FF 

JSR 

$FFBA 

• 9 

02BD 

A9 

04 


LDA 

#$04 

• 9 

02BF 

A2 

FO 


LDX 

#$F0 

• 9 

02C1 

AO 

02 


LDY 

#$02 

• 9 

02C3 

20 

BD 

FF 

JSR 

$FFBD 

• 9 

02C6 

A9 

00 


LDA 

#$00 

• 9 

02C8 

85 

9D 


STA 

$9D 

• 9 

02CA 

20 

D5 

FF 

JSR 

$FFD5 

• 9 

02CD 

4C 

00 

45 

JMP 

$4500 


1 SEND 
SCREEN 
\MSG 

] LFS 


J NME 

1 LOAD 
j MACH. PGM 

— EX MACH. 


MSG & NME HEX 

.:02D0 93 05 20 20 50 53 49 44 
.:02D8 41 43 20 IE 41 55 54 02 
.:02E0 42 4F 4F 54 20 9F 20 20 
.:02E8 20 20 20 20 20 20 20 20 
.:02F0 4D 41 43 48 00 00 00 00 
.:02F8 00 00 00 00 00 00 00 00 
.:0300 36 34 A7 02 A7 02 A7 02 
.:0308 A7 02 A7 02 00 00 00 00 


HEX DATA SHOWING ASCII CHRs 


ASCII_ 

• 02D0. r . PSID 93 05 20 20 50 53 49 44 

■ 02D8AC .AUT. 41 43 20 IE 41 55 54 02 

' 02EOBOOT . 42 4F 4F 54 20 9F 20 20 

’ 02E8 20 20 20 20 20 20 20 20 

* 02F0MACH.... 4D 41 43 48 00 00 00 00 

> 02F8. 00 00 00 00 00 00 00 00 

' 030064'.'.'. 36 34 A7 02 A7 02 A7 02 

' 0308'.'. A7 02 A7 02 00 00 00 00 
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APPENDIX □ 
SECTOR EXPLANATIONS 


The following information shows typical directory and 
data sectors. The important bytes have been numbered and 
the list identifies the meaning of the numbered bytes. 
The first part is for the directory and the second part 
for program data sectors. 


^Tells how to undelete a file. 

3 4 5 6 7 8 9 10 1,1 12 - 


fid fi@ fie fie fie fie fie fie ee 
08 00 00 00 00 82 00 00 00 82 11 
32 50 53 


11 08 31 50 53 48 4D 41 48 


BYTE 


15,16 


rectory track-12HEX 


3 48 4B 41 48 4E ft© ft© ft© 


ft© ft© ft© ft© ft© 0© 00 0© 0© 0© 0© 00 
80 0© 32 ©0 00 00 82 13 08 53 55 D0 


=jq 2. Next sector-04HEX 


=04DEC. 


45 52 44 48 52 45 
H0 0© 00 00 00 00 
00 00 82 13 0D 44 


45 43 54 4F 52 58 ft© „ ^ _ . 

08 00 00 00 00 ©8 00 3.Type of file-82HEX 


yy yy @cl yv 
4E 50 48 4s 


00=DELETED 

81=SEQUENTIAL 

82=PR0GRAM 

84=RELATIVE 


60 00 82 13 0D 44 48 53 4E 2D 45 44 uu=utLtTEU 

48 54 4F 52 fi0 00 ft© ft© ft0 00 00 00 Q^SEQUENTIAL 

6© 0© •©© 00 ©6 8© 67 00 0© 00 82 11 82-PROGRAM 

13 52 45 4C 4F 43 41 54 45 2F 4C 4F 84=RELATIVE 

4i 44 45 52 ft© 00 00 00 00 0© 0© 00 

06 00 62 80 08 00 82 10 02 44 48 53 4 - Disk File starting track- 
41: 56 48 43 4E 45 52 ft© ft© R0 ft© ft0 11HEX =17DEC 

ft© 06 08 00 88 88 00 08 00 00 11 00 

08 88 82 13 08 54 2F 53 20 41 4E 41 5. Disk File starting sector- 

40 58 5fi 45 52 ft8 ft6 ft0 ft0 00 00 00 oohex =oodec. 


86 80 00 00 00 00 08 00 00 00 82 11 

82 46 4i 53 54 42 41 43 4E ft© R0 ft0B.File NAME-1 

ft© ft© 00 ft© ft© 00 00 08 08 00 00 00 

88 08 87 80 7. -P 

TRACK 18 SECTOR 1 

12 87 82 11 0F 31 44 55 5© 44 41 43 8. -S 

R0 ft© ft© ft© ft© R0 R0 ft0 ft© 00 00 00 

00 00 08 00 00 00 11 00 00 00 82 10 9. -I 

07 32 44 55 50 44 41 43 ft© R0 ft© R0 

ft© ft© ft6 ft© ft© 00 00 00 00 00 00 00 10. -M 

08 88 11 80 88 68 82 14 02 41 44 4D 

41 43 48 ft© R8 ft© ft© R0 R0 ft© R0 ft© 11. -A 

ft© 80 88 00 80 00 08 00 00 00 01 00 

00 00 82 14 03 4D 41 43 48 52 45 40 12. -I 

4F ft© ft© ft© ft© R0 ft© R0 ft© 00 00 00 

00 00 08 00 ©0 ©0 01 0^0 00 0© 82 14 13. _ fsj 

84 33 52 4F 4D 55 40 41 54 4F 52 R0 

fit? ft© ft© ft© ft© 08 00 00 00 00 00 00 14. Ending characters —AO 

80 80 04 0© 0© 88 82 14 ©6 32 52 4F 

4D o5 4L 41 54 4F 52 ft© ft© ft© ft© R® 15. Next Entry file type-82HE> 

ft© 80 80 80 88 00 80 00 08 00 84 00 

08 86 82 13 ©8 5ft 4D 41 43 48 ft© ft® ib. Next sector 

ft© ft© ft© ft© fi0 ft© R0 ft0 ft© 00 0© 0© Data continues as above to 

08 06 ©e ©0 ©8 00 ©1 ©0 00 ©0 82 14 the end of directory . 

r-u,-. A a r— .4 J A E-i-t .•! Ti A ^ A O AO Of> ClCt J 


”10 0© 0© ©0 0© ©0 ©0 0® 14. Ending characters -AO 

3© 80 82 14 06 32 52 4F 

54 4F 52 ft© ft© ft© ft© ft®15.Next Entry file type-82HEX 

SPi Pi Pi PiPi Pi Pi 171171 Pi Pi Pi 4 Pi Pi 


08 80 08 60 08 80 01 00 00 0© 82 14 th 

05 41 4E 41 40 55 4D 41 43 48 R0 ft0 

A0 fl0 R0 80 fl0 00 00 00 00 00 00 ®©* F il 


08 08 01 00 
TRfiOK 18 


SECTOR 


ile name data is the hex 
conversion of CHR$ codes. 

** UNDELETE A FILE 


You can undelete a file only if the data has not been 
written over. Any time something has been saved on a disk 
with a deleted file, some of the data has likely been 
written over. To undelete a file, change the file type 
entry back to its original number. ie:0n a program file 
this byte should be changed to 82. 





APPENDIX □ cont 


The following information 
explains how program sectors 


I 

2 

3 

A 

5 

6 

7 






are configured. 

1*1 

0ft 

01 

08 

10 

08 

01 

00 

9E 

34 

39 

38 

1.Next track -11HEX =17DEC 

39 

31 

3fi 

50 

£2 

36 

68 

IB 

08 

02 

00 

9E 

34 

39 

39 

35 

38 

31 

34 

36 

34 

3fi 

00 

58 

3D 

£2 

08 

C2 

03 

28 

06 

34 

9E 

39 

34 

31 

2. Next sector-0AHEX = 10DEC 

sip 

2C 

38 

31 

29 

30 

3fi 

00 

91 

76 

58 

08 

89 

84 

34 

00 

2C 

54 

33 

£2 

2C 

C2 

35 

28 

3.Load TO address low byte=01 

34 

39 

39 

31 

31 

35 

35 

37 

36 

29 

29 

3ft 

3ft 

98 

53 

31 

£2 

35 

C2 

2C 

28 

22 

34 

55 

4.Load TO address high byte=08 

31 

32 

3fi 

35 

22 

3fi 

32 

9E 

3B 

34 

36 

39 

3£ 

36 

54 

39 

3B 

31 

53 

3fi 

3fi 

89 

8D 

33 

❖Thus load address =$0801 or 
2049 DECIMAL. 

88 

85 

08 

05 

00 

9E 

34 

39 

38 

35 

38 

3R 

5fi 

B2 

36 

00 

R9 

08 

06 

00 

9E 

34 

39 

39 

5.Program DATA Cin HEX) 

33 

39 

3ft 

58 

£2 

C2 

28 

34 

39 

31 

36 

31 

29 

3fi 

91 

58 

89 

37 

2C 

36 

2C 

22 

2C 

31 

R t? rr 

38 

2C 

35 

00 

DC 

08 

07 

08 

54 

£2 

C2 

28 

o 9 

34 

39 

39 

31 

31 

35 

35 

39 

38 

29 

29 

3ft 

3R 

9E 

53 B2 
34 39 

C2 

37 

28 

34 

34 

35 

7.Continues to end Csee next 

3ft 

8B 

C2 

28 

34 

39 

31 

37 

33 

29 

£2 

31 

sector and explanation#9 
and #10) 

fiF 

5ft 

B2 

31 

ft? 

36 

06 

11 

09 

08 

00 

98 

31 

35 

2C 

22 

42 

2D 

50 

3ft 22 

32 

3£ 

30 

8•End byte of THIS sector. 

Cpart of data) 

3ft 

22 

9E 

55 

34 39 37 
32 13ft-8 

31 

38 

3fl 

98 

31 

35 

2C 

TRftCK 

17 SECTOR 

6 






9.Indicates no next sector if 
00, otherwise same as above 

3*001 

9E 

22 

32 

3B 

30 

3B 

54 

3B 

53 

3ft 

8D 


35 

3fi 

5ft 

£2 

31 

3fi 

89 

36 

00 

IE 

09 

6ft 

00 

9E 

34 

39 

38 

37 

32 

3fi 

80 

00 

4fl 

except 4 S 5 would be data 

89 

19 

00 

99 

22 

05 

11 

54 

52 

4B 

2E 22 

not addresses. 

54 

22 

911 

26 

28 

22 

3fi 

99 22 

11 

53 

45 

10.Last program byte. 

43 

2E 

22 

53 

22 

9D 

26 

22 

3ft 

84 

31 

35 

2C 

41 

24 

2C 

42 

24 

00 

6D 

09 

1R 

00 

99 


22 

11 

45 

52 

52 

2E 

20 

22 

41 

24 

22 

91 


91 

91 

91 

91 

91 

22 

3R 

8£ 

41 

24 

£2 

22 


38 

30 

22 

ft? 

8E 

00 

8B 

09 

1£ 

00 

8£ 

50 


B2 

31 

ft? 

9F 

34 

2C 

34 

3R 

98 

34 

2C 

54 


2C 

53 

2C 

41 

24 

2C 

42 

24 

3fi 

R0 

34 

00 


98 

09 

1C 

00 

9E 

34 

39 

39 

30 

33 

3R I8E -10 

86 

00 

66 

06 

00 

00 

00 

60 

00 

00 

00 00 


00 

00 

00 

00 

00 

00 

00 

06 

00 

00 

00 

00 


00 

00 

06 

00 

00 

00 

00 

00 

00 

00 

00 

00 


00 

00 

00 

00 

08 

06 

00 

06 

00 

00 

00 

00 


86 

00 

00 

06 

66 

00 

00 

60 

00 

00 

00 

00 


00 

00 

00 

00 

00 

00 

00 

00 

00 

00 

00 

00 


00 

00 

00 

00 

00 

00 

00 

00 

00 

00 

06 

00 


80 

06 

00 

06 

06 

06 

00 

00 

00 

00 

00 

00 


08 

00 

00 

00 










TRftCK 

17 SECTOR 

10 
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APPENDIX E 

RESET SWITCH 



--INSTALLATION INSTRUCTIONS — 


A Reset switch is useful for breaking out of 
lockup conditions without erasing RAM data. 
Tack solder two fine wires to OUTPUT PORT 
pins 1 and 3. To keep solder from flowing 
over the entire edge connector pad, you should 
put a piece of masking tape over the pads, 
exposing only the top end for soldering. The 
switch can be mounted at any convenient 
location where it is not likely to be 
accidentally pushed. If the location you use 
is not close to the port, loop the wires 
through the ferrite donut to preserve EMI 
shielding properties. 
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APPENDIX F 
GCR INFORMATION 


The normal binary information sent From the 
computer to the disk is the binary equivalent of the 
CBM ASCII. However when the information is to be stored 
on a diskette, the DOS converts the CBM ASCII to 
another format called Group Coded Recording (GCR). In 
this process, the standard eight bit code has two extra 
bits added to it. Thus the GCR equivalent of the ASCII 
is a 10 bit number. When you load this GCR data into 
RAM and view it, you are only seeing eight of the ten 
bits at a time, so it is more difficult to analyze the 
HEX GCR code. The other effect this has is that a 256 
byte block actually takes about 320 8-bit locations on 
the disk. 

Following we have listed a GCR Sector Map, an 
example printout of a GCR Sector Image, and a list 
of the Disk drive memory locations that hold GCR header 
images. 


IMPORTANT DISK MEMORY LOCATIONS 
HEADER IMAGES 


LOC. 

BINARY DATA 

$0016 

Disk ID HI 

$0017 

Disk ID LO 

$0018 

Track 

$0019 

Sector 

$001A 

Checksum 


GCR DATA - 

$0024 

Header block ID (HBID) 

$0025 

Checksum 

$0026 

Sector 

$0027 

$0028 

Track 

$0029 

ID 1 

$002A 

$002B 

IDS 







APPENDIX F cont 


GCR BYTE MAP FOR A SECTOR 


BEGIN 

FF 

FF 

FF 

52 

XX 

XX 

XX 

XX 

XX 

XX 

XX 

55 

55 

55 

55 

55 

55 

55 

55 

55 

55 

55 

FF 

FF 

FF 

FF 

55 

XX 

XX 


SECTOR 

C 53 Sync Bytes 


Header block ID byte 

(7) Header bytes 

Checksum 

Sector 

Track 

ID 1 

ID2 

(11) Gap bytes 


(5) Sync Bytes 


Data block ID Byte 
(324) Data block byte 
DATA 


(7) Gap byte 


Checksum 
OF 
OF 
55 
55 
55 
55 
55 
55 
55 

Next Sector starts here. 


❖Note: The end oF track Gap contains several "AA” GCR 

clear bytes. 
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APPENDIX F cont 
GCR IMAGE EXAMPLE 

. : 6400 Iss) 6E E5 2D 72 9R BF 65 HEADER I 

• '6403 155 55 55 55 55 55 55 RR nFiinFn GAP (55) 

.= 6410 )55 55 2alTFl l55l D? 25 39 SYNC (FF or 7F) 55=Data 

. : 6418 32 5fl B4 fi9 HD Eft ?C BB block id 

. : 6420 97 75 CB 76 5B EB 2B 4R data 

. : 6428 B2 B4 flD 2B 4ft B2 B4 ft5 

• : 6430 29 4fl 52 94 ft5 29 4ft 52 

.=6438 94 fl5 29 52 52 94 ft5 29 

.=6440 32 5ft B4 B9 C9 Eft 7C BB 

.=6448 97 75 CB 76 5B EB 2B 4ft 

. : 6450 D2 B4 ftB 2B 4ft B2 B4 ft5 

. : 6458 29 4ft 52 94 ft5 29 4fl 52 

. : 6460 94 fl5 29 52 52 94 ft5 29 

.:6468 32 5C B4 ft7 CB EF 7fi 9C 

.:6470 F7 C9 CE 76 5F 27 3B B3 

.=6478 7B 9B 57 C9 F9 B2 B4 ft5 

.=6480 29 4ft 52 94 fi5 29 4ft 52 

.:6488 94 85 29 49 52 94 fi5 29 

. : 6498 32 5C B5 B7 39 B9 7C BB 

. : 6498 B9 75 CF 73 9B 97 B9 B5 

.=64fl0 7C E4 ftB 2B 4ft B2 B4 ft5 

.- 6488 29 4ft 52 94 ft5 29 4fl 52 

.:64B0 94 85 29 57 52 94 85 29 

.=64B8 32 5ft B7 37 C9 CF 73 SB 

.=64C0 57 4B CB 7B 9C F9 55 CB 

: : 64C8 75 5C B7 39 CF 7C B4 ft5 

.:64B0 29 4ft 52 94 ft5 29 4ft 52 

. : 64B8 94 ft5 29 52 52 94 fi5 29 

.:64E0 32 5ft 95 27 39 B9 7C BB 

. : 64E8 B7 89 B9 74 BB B7 3B F2 

.=64F0 B2 B4 ftB 2B 4ft B2 B4 R5 

.=64F8 29 4ft 52 94 85 29 4fi 52 data 

.=6500 94 85 29 6B 52 94 R5 29 

. : 6508 32 5C B5 97 Bft 55 7C E4 

. : 6510 87 2B BE 72 BC B7 E5 Fft 

. : 6518 73 BF 2B 2B 4fi B2 B4 ft5 

. : 6520 29 4fi 52 94 85 29 4fi 52 

. ; 6528 94 ft5 29 49 52 94 fl5 29 

. : 6530 32 5ft B5 27 59 CB ?C BE' 

. : 6538 E7 49 CB 74 BB BB 2B 4R 

.:6540 B2 B4 ftB 2B 4fl B2 B4 fi5 

. : 6548 29 4ft 52 94 fi5 29 4ft 52 

.=6550 94 ft5 29 57 52 97 B5 29 

. :6558 4C fl7 1 55 55 55 55 55 55 data gap 

. : 6560 |55 55 55 55 55 55l IFFl l52l ff=sync 52=hdr block id 

. : 6568 6F 75 49 72 9ft BF 651 35" 

■ : 6570 155 55 55 55 55 55 ~55 55 ~ GAP 

■ : 6578 155 551 FF1 1551 BB B5 2D 4B 

.=6580 52 B4 B5 2B 4B 52 B4 B5 

.:6588 2B 4B 52 B4 B5 2B 4B 52 

.:6590 B4 B5 2B 4B 52 B4 B5 2B 

.:6598 4B 52 B4 B5 2B 4B 52 B4 

. : 65fi@ B5 2B 4B 52 B4 B5 2B 4B formatted only 

.=65fi8 52 B4 B5 2B 4B 52 B4 B5 

.:65B0 2D 4B 52 B4 B5 2D 4B 52 

.:65E8 B4 B5 2B 4B 52 B4 B5 2B 

. : 65C0 4B 52 D4 B5 2D 4B 52 B4 

. =6508 B5 2D 4B 52 B4 B5 2D 4B 

. 651)8 52 B4 B5 2D 4B 52 D4 B5 
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APPENDIX G 


PRICE LIST 
884-1284 

******** C-64PR00UCTS ******** 


PART# DESCRIPTION PRICE(US) 


Software Protection Handbook For C-64 $19.95 

PSIPACK disk of SPH-64 programs. (Instructions in 

SPH64 only) $16.95 

SPH-64 book and PPK-1 disk combination. $29.95 

Romulator For C-64 (requires 8K or 16K Vic 

compatible RAM expander) $39.95 

16KRAM switch, (see text) (kit) $9.95 

Super Clone Plug kit. (VIC S 64) $9.95 

Tapeworm Kit. All parts, PC S inst.(VIC S 64) $19.95 

Reset switch Kit. (VIC S 64) $6.95 


******** VIC S Misc PRODUCTS ******** 


SPH-20 Software Protection Handbook For the VIC $9.95 

PT-1 Pirate’s Tape of programs in SPH-20 $9.95 

RMK-1 Romulator, VIC version (kit) $19.95 

PA-1 Protection Arsenal For VIC 20. Pirates Tape, 

Tapeworm Kit, Vic Romulator, Super Clone kit. $49.95 

SHIRT "Software Pirates" T-Shirt White Skull and 

Crossbones on jet-black Shirt. (S-M-L) $9.95 

MON-1 "SUPERMON" Disk Can be used in place of 

_ Monitor$8Q00. See Appendix B. $5.00 


❖Shipping-- add 10% to order total. ($5.00 
maximum) 

❖Overseas Airmail— add $6.00 Orders including 
SPH-64 or many items, add $10.00 

❖Canada-- allow For current exchange rate or 
obtain money order in US dollars. 

❖❖ IF not available at your local dealer, you may 
order directly From: 

PSIDAC Products Div. 

7326 N. Atlantic 
Portland, OR 97217 

Prices subject to change without notice. 
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APPENDIX H 
INTERRUPTS 


At roughly 1/BO second intervals, the C-64 takes a 
"time out" from the user program to do some of its own 
internal housekeeping. This is the "hardware interrupt" 
cycle which is a normal part of computer systems. Since 
it is automatic by nature, the user need not worry 
about it for normal purposes. The user CAN take 
advantage of it for his own routines. The limitation is 
that the routines should be short and in machine 
language. 

A control zone vector at $0314 and $0315 holds the 
address that tells where the routines to be executed 
during the interrupt are. This value is normally $EA31. 
You can write a routine wherever convenient and change 
the value at $0314 and $0315 to point to your new 
routine. Remember that the 64 still needs to do its 
own routines; so at the END of your routine you must 
have a JMP $EA31 so that the normal housekeeping will 
get done. 


*** LIMITED WARRANTY *** 


The PSIPACK diskette is guaranteed only to be free 
of defects in material and to load on a Commodore 64 
computer from a Commodore 1541 disk drive. 

PERIOD: This coverage extends for 30 days from the 
date of purchase. 

LIMITATIONS: No guarantee can be made concerning 
its application. Changes made by Commodore to the Disk 
Operating System ROM may defeat or invalidate functions 
of the programs we have provided. Neither PSIDAC nor 
any of its authorized distributors may assume any 
liability for incidental or consequential damages which 
occur through use of this product or to damages caused 
by misuse or abuse. 

REMEDY: PSIDAC will replace a diskette only if it 
is found to be defective in materials, workmanship, or 
recording and only if returned within the 30 day 
warranty period. PSIDAC will not replace diskettes 
which will not load due to misaligned heads on the 
users equipment. 
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THIRD EDITION ADDITIONS 


The following procedures work with Diskpicker to 
accomplish additional error writing capabilities. 
CREATE ERROR #27 


Places error 27 on all sectors of desired track. 

1. Load "ICON HDR",08 through monitor mode of Diskpicker. 

2. Load "WRITE HDR",08 through monitor mode. Then G C020 

3. Put object diskette in drive. 

4. Select 6 from main menu and enter track # and sector # 
desired to be errored. *If sector desired is in doubt, use 
sector #1 

5. Select-3 from main menu. 

Start Addr 0300 

End Addr 03IF 
Buff Addr 5300 

6. Select 4 from main menu. Entry addr 0300. 

7. Select 3 from main menu. 

Start Addr 0300 

End Addr 036F 
Buff Addr 3300 

8. Select 5 from main menu Job choice= 224. For execute 
start addr, select 1 =(0300) 

9. For "Multi Sector Y/N", select Y. 

10. For HDR#1, use track# to be errored. 


TO CHECK ERROR 27 


1. Select 5 from main menu. Job choice =128. 

2. For "Multi Sector Y/N", select Y. 

3. For HDR#1 use track # just errored in above procedure. 

* Sectors should read "Checksum Error In Header" 

* For more 27 errors repeat starting at step 4. 
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CREATE ERROR 29 


Places "29" error on all sectors of desired track. 


1. Load "CON HDR" through monitor mode of Diskpicker. 

2. Load "WRITE HDR",08 through monitor mode. Then type G 
C020 [RETURN] 

3. Put object diskette in drive. 

4. Select 6 from main menu and enter track# and sector# 
desired to error. *If in doubt, use sector #1. 

5. Select 1 from main menu 
Start Addr 0016 

End Addr 00IB 
Buff Addr 6016 

6. Dump memory locations 6016-601B from monitor mode. 

7. Change memory locations $6016 and $6017 to the Hex value 
of the desired ID#s. *Refer to appendix F. 


8. Select 3 from main menu 
Start Addr 0016 

End Addr 00IB 
Buff Addr 6016 

9. Select 3 from main menu 
Start Addr 0300 

End Addr 031F 
Buff Addr 5300 

10. Select 4 from main menu. Entry addr 0300 

11. Select 3 from main menu 
Start Addr 0300 

End Addr 036F 
Buff Addr 3300 

12. Select 5 from main menu. Job choice=224. For execute 
start addr select 1=(0300). 

13. For Multi Sector Y/N, select Y. 

14. For Hdr#l use track# to be errored. 

TO CHECK ERROR 29 


1. Select 5 from main menu. Job choice = 128. 

2. For Multi Sector Y/N, select Y. 


214 


■tr\ \ r*Ann ^00^0 


c 

( 

( 

c 

c 

c 

t 

( 

( 

( 

c 

( 

c 

( 

( 

c 

c 

c 

c 

c 

c 

( 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

c 

( 

( 

c 

c 

c 

c 

( 

c 


3 . For 11 l')R 1H use track # just errornd. 

* Sectors should read "DISK ID MISMATCH" 

* For more 2D Errors, repeat procedure from stop 4. 


ASSIGN illegal SECTOR #" 


This procedure will substitute an illegal sector # 
onto the diskette in place of a legal one. The illegal 
sector can bo read using the Job Que - menu option 5. 
Whenever a header not found error is encountered, make sure 
that illegal sectoring has not been used. This is done by 
loading a sector using the Job Que road function to see if 
the sector can be found in the illegal ranges specified in 
the table following step 7 of this procedure. 

1. Load "CON IIDR" through monitor mode of Diskpicker. 

2. Load "WRITE IIDR" through monitor mode. 

3. Put object diskette in drive. 

4. Select 6 from main menu and enter track# and sector # 
desired to be changed to illegal value. 

5. Select 1 from main menu. 

Start Addr 0016 

End Addr 001B 
Buff Addr 6016 


6. View memory locations 6016-601B from monitor mode. Refer 
to appendix F GCR info to identify byte function. 


7. Change data at memory location $6019 to hex value of 

sector # you want to substitute for sector # chosen in step 
4. The range of acceptable illegal sectors are: 


TRACKS 

LEGAL SECTORS 

ILLEGAL 

SECTORS 



DEC. 

HEX 

1-17 

0-20 

21-25 

15-19 

18-24 

0-18 

19-23 

13-17 

25-30 

0-17 

18-22 

12-16 

31-35 

0-16 

17-21 

11-15 


8. Select 3 from main menu 
Start Addr 0016 

End Addr 00IB 
Buff Addr 6016 

9. Select 3 from main menu 
Start Addr 0300 

End Addr 03IF 
Buff Addr 9300 


10. Select 4 from main menu. Entry Addr 0300. 

11. Select 3 from main menu 
Start Addr 0300 

End Addr 036F 
Buff Addr 3300 
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12. Select 5 from main menu. Job choice =224. For Execute 
Start Addr, select 1 (0300) 

13. For Multi Sector Y/N, select 'N'. 

14. For HDR #1, use track # selected in step 6. 

15. For HDR #2 Use one less than sector # selected in step 6. 
("Wraparound” as in earlier procedures... ie. for sector 1 
enter a 0) 

TO CHECK ILLEGAL SECTOR NUMBER 

1. Select 5 from main menu. Job choice= 128. 

2. For Multi Sector Y/N, select 'N'. 

3. For HDR #1 use track # selected in step 6 above. 

4. For HDR #2, use DECIMAL value of illegal sector number 
you selected in step 7. 

5. Even though it is an illegal value, the DOS should find 
the sector and load the data into the disk buffer. The 
sector selected in step 4 is now re-assigned to an illegal 
value. This can be verified by repeating check procedure 
steps 1-3 with a •Y* for Multi sector question, step 2. 
With a little imagination, this can be used for protecting 
your own programs quite effectively. 


SYNC ONLY 

This process will cover any desired track with GCR 
FF's for the purpose of locking up most current whole disk 
copy programs. By using this routine on several unused 
tracks, especially the lower numbered ones, you can help 
protect your own software. 

1. Load and Run Diskpicker. 

2. Select menu option 2, printer choice •N'. 

3. Input L"SYNC ONLY",08 to load machine routine. After 
load is done. Type G C020 

4. Place diskette to be errored into drive. 

5. Select menu option 7. 

6. Select menu option 3. 

Start Addr 0300 

End Addr 034F 
Buff Addr 3300 

7. After data transfer to disk, select menu option 5. 

8. Input Job choice 224. Select execute address 1 (0300). 
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9. For Multi sector Y/N, select ’ N'. 

10. For Header #1/ input track # to be errored. 

11. For header #2, input sector #0. 

12. Repeat procedure steps 7 through 10 for additional sync 
only errors. 

13. To test your errors select option 5. Job Que execute 
addr 128. 

14. For Multi Sector Y/N, select *N'. 

15. For Header #1, enter track 
with error. 

16. For Header #2, enter sector #0. 

17. If everything went right, the disk will lock up and 
continue to look for the sector you selected. 

18. The only way to escape this error is to open the drive 
door until a sync not found error shows on the monitor. 


ONE TRACK FORMAT 

This routine will reformat a single track. Can be used 
to repair any whole track error such as 22, 27, 29, Sync 
only, Multi-No Header. This routine can also be used to 
create 29 errors on a track. 

** You will need a reset switch as described to 
facilitate the use of this procedure. 

1. Load "1TRKFMT",08 through the monitor mode of diskpicker. 
Then type G CO20 

2. Put object diskette in drive. 

3. Select 7 from main menu. 

4. Select 2 from main menu and change data in memory 

locations $3312 (ID HI) and $3313 (ID LOW) to ID#s you 
want. IDs different than the one the disk was formatted 
with (False ID) will reformat the track to produce a 29 
error. Correct ID#s (same as disk formatted ID) will 
provide normal reformat. See appendix A column 1 for the 
HEX values to use for ID characters of your choice, ie. the 
hex codes for an ID of "VN"=56 4E. (56 is ID HI and 4E is 

ID LOW) 

When done, enter G CO20 

5. Select menu option 3. 

Start Addr 0300 

End Addr 0315 
Buff Addr 3300 
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6. Select menu option 5. Job choice = 224. For execute addr, 
select 1 (0300). 

7. For Multi Sector Y/N, choose 'N'. 

8. For HDR #1 use track desired to be reformatted. 

9. For HDR #2 use sector 0. 

10. Wait about 5 seconds then press computer reset, (non 
critical time). 

11. Type in SYS49184 then [RETURN]. 

12. Select menu option 7, if disk LED lamp flashes, repeat 
this step. 

TO CHECK 

1. Select menu option 5. Job choice=128. 

2. For Multi Sector Y/N, choose 'Y'. 

3. For HDR #1, select track number just reformatted. 

4. Refer to the error codes returned on your monitor which 
indicate result of your attempts. 


DETERMINING ID NUMBERS 

This process will allow you to find out the Hex value 
of ID#s on specific tracks and sectors of the disk. 

1. Assuming Diskpicker is loaded, put object diskette in 
drive. 

2. Select 7 from main menu. 

3. Select 6 from main menu, input Track # desired. Input 
Sector # desired. 

4. Select 1 from main menu. 

Start Addr 0012 

End Addr 00IF 
Buff Addr 6012 

5. Select 2 from menu and interrogate memory locations 6012- 
6018 

MEMORY LOCATION DEFINITIONS 


DISK ADDR 
$0012 
$0013 
$0016 
$0017 
$0018 
$0019 
$001A 


BUFF ADDR 
$6012= Disk ID HI 
$6013= Disk ID LOW 
$6016= Sector ID HI 
$6017= Sector ID LOW 
$6018= Track # 

$6019= Sector # 
$601A= HDR Checksum 
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The track check program was designed to provide the 
following information for full and half tracks. * 

1. Disk master ID in Hex. 

2. Actual track found in each physical track location. 

3. Header ID#s in hex for each physical track location. 

4. Status of error for each physical track location. 

To operate? load and-run "TRACK CHECK". Follow the 
screen prompts to provide your choice of options. P-Trk 
data returns the physical track called for. D-Trk returns 
the actual track found in any physical track location. In 
some forms of protection the actual track found will be 
different than the normal track number designed to be in 
that location. IDH and IDL return the actual header ID#s 
found in the physical track location. If you choose the 
half track option the data returned may or may not be 
reliable because normal track widths often overlap the half 
track areas. This program will not return valid data for 
illegal tracks having abnormal bit densities. If an 

abnormal bit density exists on a particular physical track 
location/ it will show up as a header not found error or 
some other erratic non repeatable error. 

The only commercial program diskettes we have found 
using half track or bit density errors have been on highly 
protected copy programs written to run on 1541 drives only. 
This makes these programs incompatible on other so called 
"Commodore compatible" drives. We have found some 

commercial disks with more than one track 35. Track Check 
will prove useful for most present day commercial programs. 


FORMATTING ILLEGAL TRACKS 


This procedure will format a new illegal track onto 
the diskette in place of an existing legal track. This 
process can also be accomplished in between tracks known as 
half tracks. For example: Track 34 could be reformatted as 
a track 35 resulting in two track 34s. Likewise, a physical 
location of 29.5 could be reformatted as a track 33 etc. 

It is best not to reformat a physical track location 
with format data containing more sectors than will fit in 
that location. To reformat physical track 35 as a track 1 
would present a problem because track 1 format data 
contains too many sectors to fit into the physical track 35 
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location. It is possible to have illegal ID#s on the 
illegally formatted tracks. 

An effective protection method can be utilized by 
formatting higher numbered track format data onto lower 
physical track locations. This makes these tracks 
unreadable under normal circumstances because the data will 
be formatted at a lower than normal bit density rate for 
that physical track. Disk memory location $1C00 bits 5 & 6 
control the bit density rate. 


BIT DENSITY CONTROL TABLE 


TRACK 

BITS/SEC 

Bit 

$1C00 

6 Bit 5 

1-17 

307,692•31 

1 

1 

18-24 

285,714.29 

1 

0 

25-30 

266,666.67 

0 

1 

31-35 

250,000.00 

0 

0 


To test this concept try the following procedure by 
formatting physical track 1 with format data for track 35. 
You will notice that you can find the headers etc. using 
the check procedure but you will not be able to read 
headers/data from track 1 using the T/S analyzer or Track 
Check programs as the data density is not normal in this 
location. 

The theory of this method is to make the disk drive 
memory think that it is set for track 35 and the read write 
head over track 35 while in reality the read write head is 
over track 1! This method also forces an illegal bit 
density number into memory location $1C00. By combining 
illegal half tracks and illegal ID#s with illegal bit 
densities you can achieve a high level of software 
protection. 


ILLEGAL TRACK FORMATTING 


1. Load "1TRKFMT",08 through the monitor mode of Diskpicker. 
Then G C020. 

2. Put object diskette in drive. 

3. Select 6 from main menu and enter the track # you want to 
use for format data. Then enter sector 0. This sets up the 
DOS pointers and data variables in the drive memory. 

4. Select menu option 1 
Start Addr 0000 

End Addr 00FF 
Buff Addr 6000 

This stores the Disk zero page in computer buffer. 

5. Select menu option 9 Position read write head. Enter 
your track choice for the physical track position you wish 
to format with the format data determined in step 3. 

6. Select menu option 3. 
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Start Addr 0000 
End Addr 00FF 
Buff Addr 6000 

This step restores the drive page zero to contain data for 
"illegal" track selected in step 3. 

7. Select 2 from main menu and change the data in memory 
locations $3312(ID HI) and $3313 (ID LOW) to the ID#s you 
want. Then enter G C020. (If in question about ID you want 
to use see section on determining ID numbers or use Track 
Check on original program if making backups. 

8. Select menu option 3. 

Start Addr 0300 

End Addr 0315 
Buff Addr 3300 

9. Select menu option 5. Job Choice = 224. For execute Addr 
select 1=(0300) 

10. For multi sector Y/N select N. 

11. For Hdr#l use the data track number selected in step 3. 

12. For HDR#2 use sector 0. 

13. Wait about 5 seconds then press computer reset. 

14. Type in SYS 49184 [RETURN] 

15. Select menu option 9. For track select track 18. 

16. Select menu option 7. ’ If disk LED lamp flashes repeat 
this step. 

* EXAMPLE 

If you chose track 32 for step 3 and track 34.5 for step 4, 
then you will have two track #32s, one in physical track 
position 32 and one in physical track postion 34.5. 

TO CHECK 


1. Select 6 from main menu and enter the track # that you 
chose in step 3 of the format procedure. Then enter sector 
0. 

2. Select menu option 1 
Start Addr 0000 

End Addr 00FF 
Buff Addr 6000 

3. Select menu option 9 Position read write head. Enter the 
physical track position you selected in step 4 of the 
format procedure. 

4. Select menu option 3. 

Start Addr 0000 

End Addr 00FF 
Buff Addr 6000 
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5. Select menu option *>. .lob choice = 128. 

O. For Multi Sector Y/N Select Y. 

7. For header ill select the track if you used in stop 1 of 
this chock procedure. 

8. Refer to the error codes returned on your monitor for the 
results of your attempt. 

9. Soled menu option 9. For track select track 18. 

Id. Select menu option 7. If disk LEI) lamp flashes, repeat 
this step. 
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10 POKE53230*11:POKE53281,11:P«4:D«B:HX*»"0123456789ABCDEF" 

12 0PEN15*8*15*"10":CL0SE15 

15 PRINT 0 { SCHYL> TRACK CHECK<LG> PSIDAC(C)84 VBN":FORTD=1TO2000:NEXT 

20 CH*=" NORM *: PR INT" { SC X WH1SELECT CHOICE": PRINT "<CD>(1> NORMAL TRACK CHECK" 

30 PRINT"<CD><2) HALF TRACK CHECK<CD>" 

40 INPUTCH*:IFCHS-”1"THENCH*-"NORM * 

50 IFCH*="2"THENCH*="HALF n 

100 PRINT“<CD><WH>INSERT SOURCE DISK IN DRIVE":PRINT"PRESS F7" 

110 GETF7*:IFF7*<>"<F7>"THEN110 

115 PR=0:INPUT"! CD 3-PRINTER Y/N"?YN*:IFYN**"Y"THENPR=1 
120 INPUT "<CD>DISK NAME"»DN* 

125 PRINT"!CDJTRACK LOG FOR "ON* 

130 IFPR=1THEN0PEN4»P:PRINT#4*" TRACK LOG FOR "DN*:PRINT#4:CL0SE4 
140 0PEN15*8*15*"10" 

150 PRINT#15>"M-R■CHR*(18)CHR*<0):GET#15,MH*:MH«ASC(MH*+CHR*(0)) 

152 X=MH:GOSUB3000:MH*=D* 

155 PRINT#15>"M-R"CHR*(19)CHR*(0):GET#15»ML*:ML=A5C(ML*+CHR*(0)):CLOSE15 
158 X=ML:GOSUB3000:ML*=D* 

160 PRINT"!CD>MASTER ID# = "MH*»ML*" IN HEX!CD>" 

162 IFPR=1THEN0PEN4»P:PRINT#4»"MASTER ID# = *MH*?ML*" IN HEX":PRINT#4 
165 PRINT"!CD>P-TRK D-TRK IDH IDL STATUS!CD>" 

170 IFPR=1THEN: PRINT#4* "P-TRK D-TRK IDH IDL STATUS" :PRINT#4-*CL0SE4 
172 IFCH*= 0 HALF 8 THENGO5UB500 
175 F0RTR=1T042 

182 IFCH*="HALF"THENGOSUB200:GOSUB700 

183 IFCH*=■NORM"THENGOSUB200:G0SUB295 
185 NEXT *- IFCH*=" HALF * THENGO5UB508 
190 CL0SE15:RUN 

200 OPEN15»D»15 

205 PRINT#15>"M-W"CHR*(24)CHR*(0)CHR*(1)CHR* (0) 

206 PRINT#15>"M-W"CHR*(22> CHR*(0)CHR*(1> CHR*(0) 

207 PRINT#15* “M-W"CHR* (23)CHR*<0>CHR*(1)CHR*(0) 

210 PRINTW15*"M-W"CHR*(6)CHR*(0)CHR*(1> CHR* <TR> 

220 PRINT#15?" M-W"CHR*(7)CHR* <0)CHR* <1)CHR* < 0) 

230 PRINT#15,"M-W"CHR*(0)CHR*(0)CHR*(1)CHR*(176) 

240 PRINT#15?"M-R"CHR*(0)CHR*(0) 

250 GETK15,A* : X=ASC(A*+CHR*(0)>:IFX>127THEN240 

254 OP*=" ":IFX=3THEN0P*="N0 SYNC FOUND" 

255 IFX=2THEN0P**="N0 HDR FOUND" 

258 IFX=9THEN0P*="HDR CHKSUM ERROR" 

260 PRINT#15* "M-R"CHR*(24>CHR*<0> :GET#15.CT*:CT=ASC(CT*+CHR*(0)> 

265 PRINT#15,"M-R"CHR*<22)CHR*(0):GET#15>IH*:IH=ASC(IH*+CHR*(0)) 

268 X*IH-*GOSUB3000:IH*=D* 

270 PRINT#15*"M-R"CHR*(23)CHR*(0):GET#15,IL*:IL=ASC(IL*+CHR*(0)> :CL0SE15 
272 X=IL* GOSUB3000-* IL*=D* 

275 IFCT<>0AMDCT<>TRTHENOP*="ILLEGAL TRACK" 

280 RETURN 

295 PRINTTR; TAB (6); CT; TAB (13) i IH* j TAB(17 )j IL*i TAB (22); OP* 

300 IFIL=0ANDIH=0THEN308 

305 IFIL<>MLORIH<>MHTHENPRINT" * * * % * * BAD ID# # * # # # *!CD>’:OK=l 

308 IFPR=1THENGOSUB1080 

310 RETURN 

500 0PEN15.D.15 

510 PRINT#15i r M-R"CHR*(0)CHR*(23) 

512 GETH15,X*:X=ASC<X*+CHR*(0)> 

515 BI=XAND3: BI=BI+1: BI=BIAND3*. HP= (XAND252) ORBI 

520 PRINT#15»" M-W *CHR*(0)CHR*(28)CHR*(1)CHR*(HP):CL0SE15 

530 RETURN 

700 PRINTTR"!CL >.5"> TAB(6);CT;TAB(13);IH*iTAB(17)iIL* ? TAB(22);OP* 

710 IFIL=0ANDIH=0THEN718 

715 IFILOMLORIHO MHTHENPRINT" # # * # * * BAD ID# # # # # # *!CD>":OK=l 
718 IFPR=1THENGOSUB2000 
720 RETURN 
1000 0PEN4 * P 

1010 PRINT#4*TR;CHR*(16)"08"CT?CHR*(16) B 14"IH*?CHR*<16)"13"IL*;CHR*<16)"24"0P* 
1020 IFOK=1THENOK=0:PRINT#4," # # # # * * BAD ID# ***###" 

1030 CL05E4--RETURN 
2000 0PEN4.P 

2810 PRINT#4?TR".5"CHR*(16)"08"CT* CHR*(16)"14"IH*;CHR*(16)"18"IL*; 

2012 PRINT#4*CHR*(16)"24"OP* 

2020 IFOK=1THENOK=0:PRINT#4," * # # a # a BAD ID# ######" 

2030 CL0SE4-* RETURN 

3000 D*=" " *-Dl=INT(X/16) - D*=D*+MID*(HX*»D1+1»1) 

3010 D2=INT(X-16^D1>:D*=D*+MID*(HX*,D2+1* 1):RETURN 


) 
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THE 

SOFTWARE 
PROTECTION 
HANDBOOK 
For the C-6L 


CONTRARY TO POPULAR BELIEF, WHEN YOU BUY 
SOFTWARE, YOU OWN MORE THAN JUST THE 
LIGHT RAYS FROM YOUR TV ! 

IT IS TIME TO DEFROCK THE WIZAROS BY 
RELEASING INFORMATION ON THE "BLACK ARTS," 
OF PROTECTION. YOU NO LONGER NEED SEEK 
OUT THE CRUMBS OF INFORMATION DOLED OUT 
3Y THE LOCAL WIZARD OR HINTED AT IN THE 
MAGAZINES. 

THIS MANUAL WILL HELP YOU "BLOW THE LOCKS 
OFF" PROTECTED SOFTWARE! THE SOFTWARE 
PROTECTION HANDBOOK LETS YOU KNOW WHERE 
YOU STAND LEGALLY AND PROVIDES 
INFORMATION ON PROTECTION TECHNIQUES AND 
BREAKING FOR EACH CATEGORY OF SOFTWARE; 
DISKS, CARTRIDGES, AND TAPES. THIS MANUAL 
ALSO GIVES THi LISTINGS AND PROCEDURES 
FOR ELEVEJ1 PB2IE£11QJ1 ANALYSIS AND 
BREAKING TOOLS . 

THE REFERENCE VALUE ALONE WILL KEEP YOU 
TURNING BACK TO THIS BOOK FOP AS LONG AS 
YOU OWN YOUR COMPUTER. YOUR BIGGEST 
PROBLEM WILL BE IN KEEPING YOUR COMPUTING 
FRIENDS FROM BORROWING YOUR COPY OF THIS 
BOOK!I! 
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